Privacy Policy

1. General Information

This Privacy Policy sets out the rules for the processing of personal data by:

Data Controller:

Przedsiębiorstwo Produkcyjno Usługowe Katarzyna Handschuh - Strugalska

Poniatowskiego 15, 62-030 Luboń, Poland

NIP (Tax Identification Number): 7811371395

The Controller pays special attention to protecting users' privacy and the security of personal data, processing them in accordance with the EU General Data Protection Regulation (GDPR) and Polish law. The Controller has not appointed a Data Protection Officer (DPO). In all matters relating to the protection of personal data, please contact us at the following e-mail address: info@loomonatural.com.

2. Scope of Processed Data

The Controller processes personal data in the following scope:

first and last name,
e-mail address,
phone number,
delivery address,
invoice data (including NIP/VAT number in the case of companies),
IP address,
data contained in contact and order forms.

3. Purposes of Data Processing

Personal data are processed for the purpose of:

processing orders and providing electronic services,
handling complaints and returns,
fulfilling accounting and tax obligations,
contacting the Customer,
marketing own products (only with prior consent).

4. Legal Basis for Processing

Data are processed based on the following GDPR provisions:

Art. 6(1)(b) GDPR – taking steps prior to entering into a contract or performance of a sales contract,
Art. 6(1)(c) GDPR – legal obligation to which the Controller is subject (in particular, tax law and accounting act provisions),
Art. 6(1)(a) GDPR – user's consent (e.g., for marketing activities, newsletter, analytical cookies),
Art. 6(1)(f) GDPR – legitimate interest of the controller, consisting of: establishing, exercising, or defending against potential legal claims and ensuring the security of the IT environment.

5. Data Recipients

Personal data may be transferred to cooperating entities, in particular:

courier and postal companies delivering parcels,
electronic payment operators (including the Przelewy24 system),
entities providing accounting services,
IT and hosting service providers (including the Wix.com Ltd. platform).

6. Transfer of Data Outside the European Economic Area (EEA)

Due to basing the store's infrastructure on the WIX platform, personal data may be transferred outside the EEA (e.g., to Israel or the USA). In the case of Israel, the transfer takes place on the basis of a European Commission decision stating an adequate level of protection. In the case of transfer to other third countries (e.g., the USA), the Controller ensures that it takes place on the basis of the Data Privacy Framework (applicable from 2023) or Standard Contractual Clauses approved by the European Commission, which guarantees a lawful level of protection.

7. Data Retention Period

Personal data are stored for the period necessary to achieve the purposes for which they were collected:

Transactional and contractual data: for the duration of the contract, and then until the expiry of the limitation period for claims (standardly 3 years in the case of B2B relations and 6 years in the case of consumers, counting from the claim due date).
Accounting and tax data: for a period of 5 years, counting from the end of the calendar year in which the tax payment deadline expired.
Data processed on the basis of consent (e.g., marketing, newsletter): until its withdrawal by the User or for a period of 3 years from the User's last activity.

8. User Rights

Every data subject has the right to:

access their data and receive a copy thereof,
rectify (correct) them,
erase them (right to be forgotten),
restrict processing,
data portability,
object to processing (in particular in the case of processing based on a legitimate interest under Art. 6(1)(f) GDPR, in accordance with Art. 21 GDPR),
withdraw consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal),
lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (PUODO) in Poland.

9. Automated Decision-Making and Profiling

Users' personal data are not subject to automated decision-making which would produce legal effects concerning them or similarly significantly affect them; in particular, they are not subject to profiling.

10. Cookies

In principle, the website uses only necessary cookies (so-called "technical cookies") in order to ensure the proper functioning of the website, maintain the User's session, and operate the shopping cart mechanism. The store does not use cookies for analytical or marketing purposes that require consent, and therefore does not employ a consent mechanism (cookie banner). The User can block cookies through their web browser settings; however, blocking necessary cookies may prevent the completion of the purchasing process.

11. Data Security

The Controller applies appropriate technical and organizational measures to ensure the protection of processed personal data, appropriate to the threats and categories of data protected. In particular, it secures data against unauthorized access, loss, or damage, using, among others, SSL/TLS certificates.

12. Final Provisions

The Controller reserves the right to make changes to this Privacy Policy. The current version of the document is always published on this website. Users who have an account in the store or are subscribed to the newsletter will be informed of significant changes in the rules of data processing by e-mail at least 7 days in advance.

In the event of any discrepancies between the Polish and English versions of this Privacy Policy, the Polish version shall prevail.