Privacy Policy

PRIVACY POLICY OF THE ONLINE STORE

www.aplauz-equestrian.com

1. The Personal Data Administrator of the Online Store available at www.aplauz-equestrian.com (hereinafter referred to as the Online Store) is Milena Debrovner, conducting business under the name Milena Debrovner, with a permanent place of business at ul. Kozanowska 93, 54-152, Wrocław, registered in the Central Register and Information on Economic Activity, NIP: 8943230574, REGON: 527905701 (hereinafter referred to as the Personal Data Administrator).
2. Any inquiries, requests, or complaints regarding the processing of personal data by the Personal Data Administrator (hereinafter referred to as Requests) should be directed to the following email address: contact@aplauz-equestrian.com or in writing to ul. Kozanowska 93, 54-152, Wrocław. The Request should clearly indicate:
   
   1. the data of the person(s) to whom the Request pertains,
   2. the event that caused the Request,
   3. the request itself along with the legal basis for it,
   4. the expected resolution of the matter.
3. The following personal data is collected in our Online Store:
   
   1. name and surname – may be processed when users provide it via email, contact form, registration form, order form available in our Online Store, through traditional mail or phone contact in order to use our Online Store’s offer,
   2. phone number – may be processed in case of phone contact, as well as when the user provides it via email, contact form, registration form, or order form. The phone number is processed to allow us to contact the user regarding order fulfillment or to answer inquiries,
   3. address (residental or mailing) – processed to correctly ship ordered products; it is required when making purchases in our Online Store,
   4. e-mail address – may be processed when provided by the user via email, contact form, registration form, or order form, as well as via traditional mail or phone contact. Through email, we respond to inquiries related to our offer and provide information regarding contract fulfillment. Additionally, if the user has consented to receiving marketing content and subscribed to our newsletter, we will send commercial and marketing information a few times a month,
   5. IP address of the device and potential personal data contained in Cookies – information resulting from general internet connection principles, such as IP address (and other system log information), used for technical and statistical purposes, including collecting general demographic information (e.g., about the region from which the connection is made). These data are also used for marketing and analytical purposes if consent is given,
   6. NIP (Tax Identification Number) and company name – required for issuing invoices and other documents related to using our Online Store,
   7. other data may be collected as part of specific cases or provided by users via email, the contact form available in the Online Store, traditional mail or phone contact.
4. Each person using our Online Store can choose whether and to what extent they want to use our services and share their information within the scope outlined in this Privacy Policy.
5. Personal data is processed for the following purposes:
   
   1. Making purchases in our Online Store via the order form available on the website (Article 6(1)(b) of GDPR) – in this case, personal data will no longer be processed once the specific transaction is completed,
   2. concluding and executing contracts related to our services (Article 6(1)(b) of GDPR) – in this case, personal data will no longer be processed once the contract is fulfilled,
   3. managing individual user accounts (Article 6(1)(b) of GDPR) – personal data will be deleted once the user removes their account,
   4. providing marketing content related to the Administrator and conducting website analytics regarding the use of Cookies (Article 6(1)(a) of GDPR) – personal data is processed until the session ends, the Cookies are deleted by the user, consent is withdrawn, or a valid objection to processing is made,
   5. operating the website (Article 6(1)(f) of GDPR) – personal data will no longer be processed once the relevant Cookie expires, the Cookies are deleted, or the session ends,
   6. providing a newsletter subscription service (Article 6(1)(a) of GDPR) – personal data will be deleted once consent is withdrawn and the user unsubscribes from the newsletter,
   7. fulfilling legal obligations (Article 6(1)(c) of GDPR), such as keeping records and issuing invoices – in this case, personal data will be deleted after fulfilling the relevant legal obligations,
   8. ongoing communication related to the Online Store’s operation (Article 6(1)(f) of GDPR – Administrator’s legitimate interest) – personal data will no longer be processed once the inquiry is answered,
   9. establishing, pursuing, or defending claims (Article 6(1)(f) of GDPR – Administrator’s legitimate interest) – personal data will be deleted once claims expire, generally after a three-year limitation period.
6. The source of the processed personal data is the users themselves.
7. If a button or function links to an external service, application, or social media, there is a co-administration relationship between the Administrator and the external service provider. Co-administration is limited to data necessary for the operation of the button or function. The Administrator is not responsible for the data processing policies of other entities, organizations, or social media providers. Our co-administrators within this Online Store are:
   
   1. Meta Platforms Ireland Ltd. (Facebook, Facebook Pixel) located at: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irleand,
   2. Google Ireland Ltd. located at: Google Building Gordon House, 4 Barrow St, Grand Canal Dock, Dublin 4, D04 V4X7, Irleand,
   3. Others, if applicable.
8. The Administrator uses tools from Google Ireland Ltd. (Google Workspace, Google Analytics, Google Drive, Gmail) and Meta Platforms Ireland Ltd. (Facebook Pixel). Generally, data processed via these tools is stored on servers within the EEA. However, these providers may be required to transfer data to third countries if legally obligated or necessary due to service characteristics (SaaS, hosting, etc.). The scope of personal data transfers in this regard applies to all personal data specified in section 3 of this Privacy Policy. The legal basis for processing such personal data has been specified in section 5(d) and (e) of this Policy. The transfer of personal data to the United States is based on the European Commission’s Adequacy Decision of July 10, 2023, under the EU-U.S. Data Privacy Framework (Article 45(1) GDPR). Our data importers, Google LLC and Meta Platforms, Inc., comply with this framework and are listed at: https://www.dataprivacyframework.gov/s/participant-search. Google Ireland Ltd. and Meta Platforms Ireland Ltd. may transfer data to third countries based on their Standard Contractual Clauses.
9. We do not share any personal data with third parties without the explicit consent of the data subject. Data may be shared without the data subject’s consent only with entities authorized to process personal data under applicable legal provisions (e.g., law enforcement agencies, the Social Insurance Institution (ZUS), or the Tax Office). The administrator shares personal data of its clients in particular with: payment operators, companies providing postal and courier services, and tax authorities.
10. Personal data may be entrusted for processing to entities that process such data on our behalf as the Data Controller. In such a case, as the Data Controller, we enter into a data processing agreement with the processor. The processor processes the entrusted personal data solely for the purposes, within the scope, and for the objectives specified in the data processing agreement mentioned in the previous sentence. Without entrusting personal data for processing, we would not be able to operate our online store or deliver shipments with ordered products. As the Data Controller, we entrust personal data for processing to the following entities, in particular:
    
    1. entities providing hosting services for the website on which our online store operates,
    2. entities providing accounting services,
    3. entities providing other services on our behalf that are necessary for the ongoing operation of the online store.
11. Personal data is not subject to profiling by the Administrator under GDPR regulations.
12. In accordance with the provisions of the GDPR, each person whose personal data we process as a Personal Data Controller has the right to:
    
    1. access their personal data, as referred to in Art. 15 GDPR,
    2. be informed about the processing of personal data, as referred to in Article 12 of the GDPR,
    3. correct, supplement, update, rectify data, as referred to in Article 16 of the GDPR,
    4. withdraw consent at any time, as referred to in Article 7(3) GDPR,
    5. erase data (right to be forgotten), as referred to in Article 17 GDPR,
    6. restriction of processing, as referred to in Article 18 GDPR,
    7. data portability as referred to in Article 20 GDPR, 
    8. object to the processing of personal data, as referred to in Article 21 GDPR,
    9. in the case of the legal basis, in the form of consent – the right to withdraw consent at any time without affecting the legality of the processing carried out on the basis of consent before its withdrawal,
    10. not to be subject to profiling, as referred to in Article 22 in connection with Article 4(4) of the GDPR,
    11. file a complaint with the supervisory authority (i.e., the President of the Office for Personal Data Protection) referred to in Article 77 of the GDPR.
13. If you wish to exercise your rights referred to in the preceding paragraph, please send a message by e-mail to the e-mail address or in writing to the mailing address referred to in paragraph. 2 above.
14. Each identified security breach is documented, and if one of the situations specified in the provisions of the GDPR or the Law, data subjects are informed of such a data breach.
15. The Cookie Policy is a separate document available at: https://aplauz-equestrian.com/cookie-policy/
16. In matters not regulated by this Privacy Policy, the relevant provisions of generally applicable law shall apply accordingly. In the event of any inconsistency between the provisions of this Privacy Policy and the aforementioned regulations, these regulations shall prevail.