Privacy policy 33ml.com
§ 1 General Provisions
- The data controller of users’ personal data for the website under the domain www.33ml.pl is Global Cosmetics Szadkowski Marek, 96-320 Mszczonów, ul. Targowa 9, NIP 838-105-50-86 (hereinafter referred to as the “Administrator”).
- Contact with the Administrator is possible: (1) via email at biuro@33ml.pl, (2) through the contact form available on the website.
- The purpose of this Policy is to define the actions taken concerning personal data collected through the Administrator’s website and related services and tools used by its users, as well as in the process of concluding and executing contracts outside the website.
- If necessary, the provisions of this Policy may be amended. Changes will be communicated to users by publishing the new Policy content, and in the case of individuals who have consented to data processing via email or provided their email details for contract execution, they will also be notified via email.
§ 2 Basis, Purpose, and Storage of Personal Data
- Users’ personal data is processed in accordance with the General Data Protection Regulation (GDPR), the Personal Data Protection Act, the Personal Data Protection Act of May 10, 2018, and the Act on the Provision of Electronic Services of July 18, 2002.
- In cases where personal data is processed based on an email sent by the user or a complaint, such processing occurs under Article 6(1)(b) of the GDPR, which states that processing is necessary to take action at the request of the data subject.
- If separate consent is obtained from the user, their personal data may also be processed for marketing purposes by the Administrator, including the delivery of commercial information via email provided by the user (Article 6(1)(a) of the GDPR).
- For the conclusion and execution of sales agreements or service contracts by the Administrator, the other party is required to provide the necessary data to conclude the contract (which is a contractual requirement and, in the case of tax identification numbers, a legal requirement), and for this purpose, the Administrator processes personal data (Article 6(1)(b) of the GDPR).
- For conducting research and analysis to improve available services (e.g., tracking tools), the legal basis for data processing is Article 6(1)(f) of the GDPR.
- Users’ personal data is stored no longer than necessary to achieve the processing purpose, i.e., until consent is withdrawn if processing is based on consent, until the expiration of claims for the Administrator and the other party regarding contract performance (for sales/service agreements, 2 years, counting until the end of the year), and until the query submitted via email is processed or a complaint is resolved.
- The Administrator may use profiling for direct marketing purposes; however, decisions made based on profiling do not involve the conclusion or refusal of a contract or the ability to use electronic services. The result of profiling may include offering a discount, sending a discount code, reminding about incomplete purchases, suggesting products matching the user’s interests or preferences, or proposing better terms than the standard offer. Despite profiling, the individual freely decides whether to use the received discount or better terms and proceed with the purchase. Profiling involves automatic analysis or prediction of a user’s behavior on the Administrator’s website, e.g., adding a specific product to the cart, viewing a product page, or analyzing past activity history on the site. The prerequisite for such profiling is the Administrator possessing personal data of the individual to send, for example, a discount code.
- Considering the nature, scope, context, and purposes of processing, as well as the risks of violating individuals’ rights and freedoms with varying probabilities and severity, the Administrator implements appropriate technical and organizational measures to ensure compliance with the regulation and demonstrate such compliance. These measures are reviewed and updated as necessary. The Administrator applies technical measures to prevent unauthorized persons from acquiring or modifying personal data transmitted electronically.
§ 3 Data Sharing
- The Administrator ensures that all collected personal data is used to fulfill obligations towards users. This information will not be shared with third parties, except in cases where:
- explicit consent has been granted by the individuals concerned, or
- there is a legal obligation to provide such data, e.g., to law enforcement authorities.
- Additionally, personal data of service recipients and customers may be transferred to the following recipients or categories of recipients:
- Service providers supplying the Administrator with technical, IT, and organizational solutions, enabling the Administrator to conduct business activities, including the website and electronic services provided through it (e.g., software providers, marketing agencies, email and hosting providers, business management software providers, and customer support operators). The Administrator provides collected customer personal data to the selected provider only when and to the extent necessary to fulfill the data processing purpose in line with this privacy policy.
- Providers of accounting, legal, and advisory services supporting the Administrator in accounting, legal, or consulting matters (e.g., accounting firms, law firms, or debt collection companies). The Administrator provides collected personal data to the selected provider only when and to the extent necessary to fulfill the data processing purpose in accordance with this privacy policy.
§ 4 User Rights
- The user whose personal data is processed has the right to:
- Access, rectify, restrict, delete, or transfer – the data subject has the right to request access to their personal data, rectification, deletion (“right to be forgotten”), or restriction of processing and has the right to object to processing, as well as the right to data portability. The detailed conditions for exercising these rights are specified in Articles 15-21 of the GDPR.
- Withdraw consent at any time – if data is processed based on consent (under Article 6(1)(a) or Article 9(2)(a) of the GDPR), the user has the right to withdraw consent at any time without affecting the lawfulness of processing before its withdrawal.
- Lodge a complaint with a supervisory authority – the user whose data is processed by the Administrator has the right to lodge a complaint with the supervisory authority in accordance with GDPR regulations and Polish law. In Poland, the supervisory authority is the President of the Personal Data Protection Office in Warsaw.
- The user ensures that the data provided or published by them on the service is accurate.
§ 5 Cookies
- Cookies refer to IT data, particularly text files stored on users’ end devices (usually on a computer’s hard drive or a mobile device) to save certain settings and data through the user’s browser for website usage. These files allow user devices to be recognized and appropriately display the website, ensuring a comfortable experience. Storing cookies enables proper website and service customization based on user preferences—recognizing visits, clicks, and previous actions.
- Cookies contain, in particular, the domain name of the website they originate from, their storage duration on the user’s device, and a unique number used to identify the browser connecting to the website.
- Cookies are used to:
- Adjust website content to user preferences and optimize website usage,
- Create anonymous statistics that help improve website structure and content by understanding how users interact with the site,
- Deliver website users with advertising content tailored to their interests.
Cookies do not serve to identify users, and their identity is not established based on them.
- The primary division of cookies includes:
- Essential cookies – absolutely necessary for the proper functioning of the website or services the user wishes to use, as without them, we would not be able to provide many of our services. Some also ensure the security of services provided electronically.
- Functional cookies – important for website operation as they:
- Enhance website functionalities; without them, the site will still function correctly but won’t be optimized for user preferences,
- Ensure a high level of functionality; without them, site usability may decrease, but their absence should not prevent full use,
- Support most website functionalities; blocking them may cause some features to malfunction.
- Business cookies – enable the business model under which the website is provided; blocking them won’t make functionalities unavailable but may reduce the level of service due to the inability of the website owner to generate revenue to subsidize its operation. This category includes advertising cookies.
- Configuration cookies – allow website functions and service settings to be customized.
- Security and reliability cookies – verify authenticity and optimize website performance.
- Authentication cookies – notify when a user is logged in, allowing the website to display appropriate information and features.
- Session state cookies – save information about how users interact with the website, such as most frequently visited pages or error messages displayed. These cookies help improve services and enhance browsing comfort.
- Process monitoring cookies – enable smooth website operation and the availability of its functions.
- Advertising cookies – allow the display of ads more relevant to users and more valuable to publishers and advertisers. Cookies may also be used to personalize ads and display them outside the website.
- Location-based cookies – adjust displayed content to the user’s location.
- Analytical, research, or audit cookies – help website owners better understand user preferences and, through analysis, improve and develop products and services. Generally, the website owner or research firm collects anonymous information and processes data on trends without identifying specific users.
- Using cookies to tailor website content to user preferences does not typically involve collecting any personally identifiable information. However, in some cases, such information may be considered personal data, meaning certain behaviors could be linked to a specific user. Personal data collected via cookies is only used to perform specific functions for the user. Such data is encrypted to prevent unauthorized access.
- Cookies used by this website are not harmful to users or their end devices. To ensure the proper functioning of the website, it is recommended not to disable cookies in browsers. In many cases, browser software (web browsers) allows cookies and similar technologies to be stored on the user’s end device by default. Users can modify how their browser handles cookies at any time. The method for changing settings varies depending on the browser. Instructions can be found on the respective browser’s help page.
- Cookies are also used to facilitate user account login, including through social media, and to enable seamless navigation between website subpages without the need to log in again on each page. Additionally, cookies help secure websites, e.g., preventing unauthorized access.
- As part of cookie technology, the Administrator may use tracking pixels or clear GIFs to collect information about how users interact with the services and respond to marketing messages sent via email. A tracking pixel is a software code that embeds an object on a page, typically a pixel-sized image, which allows monitoring of user behavior on the websites where it is placed. If the appropriate consent is given, the browser automatically establishes a direct connection with the server storing the pixel, meaning that the data collected via the pixel is processed according to the data protection policy of the partner operating that server.
- The Administrator may use web log files (containing technical data such as user IP addresses) to monitor traffic within its services, resolve technical issues, detect and prevent fraud, and enforce the terms of the User Agreement.
- The Administrator informs users that the website does not respond to Do Not Track (DNT) signals. However, users can disable certain types of tracking online, including some analytics and personalized advertising, by adjusting their cookie settings in their browser or through our cookie consent tools (if applicable).
- Detailed information on changing cookie settings and manually deleting them in the most popular web browsers can be found in the browser’s help section or on the following pages:
- Detailed information about managing cookies on a mobile phone or another mobile device should be available in the device’s user manual.