Contents:

1. General provisions
2. Personal Data Administrator
3. Contact details
4. Rules for the processing of personal data
5. Purposes and legal grounds for processing personal data
6. Period of storage of personal data
7. Categories of personal data
8. Cookies
9. Data sharing
10. Clients' rights

1.1 General provisions

This Privacy Policy sets out the rules for the processing and protection of personal data of customers using the online store available at ibra-makeup.pl (hereinafter referred to as the "Online Store").

This Privacy Policy fulfills the information obligation imposed on the Administrator in accordance with art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation personal data) (hereinafter referred to as "GDPR").

1.2 Personal Data Administrator

The administrator of the personal data of the customers of the online store is Aruba Bober Rafał Kosiorowski Grzegorz with its registered office in Rzeszów, Aleja Tadeusza Rejtana 8, 35-310 Rzeszów, NIP: 8133265629. REGON: 691579051 (hereinafter referred to as the "Administrator").

1.3 Contact details

The Administrator can be contacted via the e-mail address shop@ibra-makeup.pl or in writing to the following address: Firma Aruba Bober Rafał Kosiorowski Grzegorz, Aleja Tadeusza Rejtana 8, 35-310 Rzeszów.

1.4 Rules for the processing of personal data

The Administrator processes Customers' personal data in accordance with the provisions of the GDPR.

The administrator uses the technical and organizational measures required by the provisions of EU law to ensure the protection of personal data being processed and the protection of personal data against disclosure to unauthorized persons, acquisition by unauthorized persons, processing in violation of the provisions and change, loss or destruction.

The Administrator declares that providing data marked as required in the Online Store is voluntary, but necessary to use the functionality, including setting up and maintaining a Customer account and placing and processing an order.

The customer may agree to receive commercial information from the Administrator, including by means of electronic communication and to use telecommunications terminal equipment for marketing purposes. Expressing the above consents is voluntary, it is not a condition for the execution of the order or maintaining the Customer's account in the Online Store.

1.5 Purposes and legal grounds for processing personal data

Customers' personal data will be processed for the following purposes:

• keeping and maintaining the Customer's account in the Online Store (Article 6(1)(b) of the GDPR),
• execution of orders in the Online Store (Article 6(1)(b) of the GDPR),
• contact related to the performance of the contract, as well as sending marketing information (including the newsletter),
• direct marketing of own services and products, which is the legitimate interest of the Administrator (Article 6(1)(f) of the GDPR),
• replying to a message sent via the contact form (Article 6(1)(a) of the GDPR),
• implementation of the complaint or withdrawal process (Article 6(1)(c) of the GDPR),
• running the newsletter service (Article 6(1)(a) of the GDPR),
• archival (evidence) in the event of a legal need to prove facts, which is the legitimate interest of the Administrator (Article 6(1)(f) of the GDPR),
• possible determination, investigation or defense against claims being the implementation of the Administrator's legitimate interest (Article 6(1)(f) of the GDPR).

1.6 Period of storage of personal data

Personal data will be stored for the duration of the contract and for a period in accordance with applicable regulations, taking into account the statute of limitations for claims and tax liabilities.

Personal data for the processing of which you have consented will be stored until you withdraw your consent.

Customer data will be stored for the following period:

• data regarding the maintenance of the Customer's account - for the period of its maintenance in the Online Store and within 1 year from the moment the Customer submits a request to delete it,
• data related to the execution of orders - for a period of 5 years from the end of the year in which the sale was made,
• data related to the implementation of marketing activities - within 1 year from the moment of the Customer's objection to the processing of his data based on art. 6 sec. 1 point f) GDPR,
• data related to answering the inquiry - within 3 months from the withdrawal of the consent.
• data related to the implementation of the complaint process or withdrawal from the contract - for a period of 5 years from the end of the year in which the complaint was considered or the contract was withdrawn,
• running the newsletter service - within 1 year from the moment of unsubscribing from the newsletter.
• archival purposes - for the period necessary to achieve this purpose,
• establishing, investigating or defending against claims - for the period necessary to achieve this goal.

Your personal data may be transferred to the payment operator and courier company. The customer has the right to inspect and change his personal data at any time, as well as to request the Administrator to immediately remove them ("the right to be forgotten"). You can submit requests regarding the processing of personal data by e-mail to the data controller's address.

The Administrator undertakes to make efforts to maintain proper protection of the Customer's personal data.

1.7 Categories of personal data

The Administrator, through the Store and other forms of communication, collects, stores and processes the following personal data of Customers provided during the registration processes on the Website: name and surname, address of residence, e-mail address, telephone number, company name and details (company name, address, tax identification number).

1.8 Cookies

The administrator does not collect any data automatically, except for the data contained in cookies when using the Online Store.

Cookies are IT data, in particular text files, which are stored in the Customer's end device and are intended for using the Online Store. Cookies usually contain the name of the website they come from, their storage time on the end device and a unique number.

Cookies are used for the following purpose:

• recognition of the device used by the Customer in order to properly display the content of the website,
• creating statistics that help to understand how customers use websites, which allows improving their structure and content,
• maintaining the Customer's session of the Online Store, thanks to which the Customer does not have to re-enter the login and password on each subpage of the Online Store,
• adjusting the content and functioning of the Online Store by matching an anonymous, randomly generated tracking ID, thanks to which it is possible, among others, to checking where the Customer comes from, what search engine he used, what link he clicked on, what keywords he entered and at what point he stopped using the Online Store,
• collecting general and anonymous data for the implementation of advertising campaigns via remarketing lists, allowing for the display of advertising content tailored to the Customer's preferences.

Web browsers usually allow cookies to be stored on the Customer's end device by default. Customers can change the settings in this regard. The web browser allows you to delete stored cookies, as well as automatically block them. Detailed information on this subject can be found in the help or documentation of the web browser.

1.9 Data sharing

In order to perform the contract concluded via the Online Store, the Administrator provides Customers' personal data to the following entities:

• postal operators,
• payment system operators,

1.10 Clients' rights

The customer has the right to access his data and the right to request their rectification, deletion, processing restrictions. To the extent that the basis for the processing of personal data is the premise of the legitimate interest of the administrator, the Customer has the right to object to the processing of his personal data.

To the extent that the basis for the processing of the Customer's personal data is consent, the Customer has the right to withdraw consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

To the extent that the Customer's data is processed for the purpose of concluding and performing the Agreement or processed on the basis of consent - the Customer also has the right to transfer personal data, i.e. to receive personal data from the administrator, in a structured, commonly used machine-readable format . The customer may send this data to another data controller. The right to transfer data does not apply to data that is a company secret.

The customer has the right to access their data and the right to rectify it, delete it, and limit processing.

The customer also has the right to lodge a complaint with the supervisory body dealing with the protection of personal data - the President of the Office for Personal Data Protection.

The Administrator undertakes to make efforts to maintain proper protection of the Customer's personal data.

"In matters not covered by the regulations, the provisions of the Civil Code and relevant acts of Polish law, as well as European Union law, in particular the GDPR (Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons in with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC).”.