Privacy Policy

The Data Controller responsible for the processing of personal data is:

PACK PACK SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ

Legionów 43

Łódź, 91-069

kontakt@packpack.pl

Thank you for your interest in our online store. Protecting your privacy is very important to us. Below you will find detailed information on how we handle your data.

1. Access Data and Hosting

You can visit our websites without providing any personal information. Each time a website is accessed, the server automatically records only the so-called server logs, such as the name of the requested file, your IP address, the date and time of access, the amount of data transmitted, and the requesting internet service provider (so-called access logs), and documents the access.

These data are analysed solely for the purpose of ensuring the proper functioning of our website and improving our offer. This is in accordance with Art. 6(1)(f) of the GDPR, to safeguard our legitimate interest in an optimal, correctly functioning presentation of our website and offer. All access data is deleted within seven days of the end of your visit to the website.

Hosting

The services for hosting and displaying the website are partly provided by our service providers as part of data processing on our behalf. Unless otherwise stated in this privacy policy, all access data and data collected in forms provided on our website are processed on their servers. If you have any questions regarding our service providers and the basis of our cooperation with them, please contact us. Our contact details can be found in the section "Our Contact Details and Your Rights."

2. Collection and Processing of Data for Contract Execution, Contact Purposes, and Customer Account Setup

We collect personal data only when you voluntarily provide it to us when placing your order or contacting us (e.g., via contact form or email). Mandatory fields are marked as such because the data is necessary for the execution of the contract or to address the issue you are contacting us about. Without these data, we cannot complete your order or respond to your inquiry. The data collected is evident from the respective input forms. We use the data provided by you in accordance with Art. 6(1)(b) of the GDPR for contract execution and responding to your inquiries. Furthermore, if you have given your consent in accordance with Art. 6(1)(a) of the GDPR to create a customer account, we will process the personal data necessary for this purpose. Further information on the processing of your data, particularly regarding the transfer of data to our service providers for order processing, payment, and shipping, can be found in subsequent sections of this privacy policy.

Once the contract has been fully executed or your customer account has been deleted, your data will be restricted for further processing, and after the retention periods required by tax and accounting laws have expired, the data will be deleted (Art. 6(1)(c) of the GDPR), unless you have expressly consented (Art. 6(1)(a) of the GDPR) to further use of your data or we reserve the right to further use your data in legally permitted cases, which we inform you about in this privacy policy. Your customer account can be deleted at any time. To do so, please send a message to our contact address provided in the section "Our Contact Details and Your Rights" or use the appropriate function in your customer account settings.

Goods Management System

To manage orders and execute contracts, we also use an external goods management system. Our service providers provide us with services in this area as part of data processing agreements. If you have any questions about our service providers and the basis of our cooperation with them, please contact us. Contact details can be found in the section "Our Contact Details and Your Rights."

3. Data Transfer for Delivery Purposes

To fulfil the contract (Art. 6(1)(b) of the GDPR), we transfer your data to the shipping company selected by you during the order process for the delivery of the ordered products.

4. Data Processing for Payment Purposes

To process payments in our online store, we work with external service providers who handle electronic payments online and transfer your data to the payment service provider chosen by you during the order process. This serves to fulfil the contract (Art. 6(1)(b) of the GDPR).

Data Processing for Fraud Prevention and Payment Optimisation

In certain situations, we may provide our service providers with additional information, which they may use along with the information necessary to process the payment. These service providers act on our behalf as data processors and provide services such as fraud prevention and payment process optimisation (e.g., invoicing, analysis of disputed payments, accounting support). This is in accordance with Art. 6(1)(f) of the GDPR to safeguard our legitimate interests in protecting against fraud and abuse and in the effective management of payments.

5. Marketing Channels: Email

Email Advertising after Newsletter Signup

If you subscribe to our newsletter, we will use the data required for this purpose or provided separately by you to send you our newsletter regularly via email based on your consent (Art. 6(1)(a) of the GDPR). You can unsubscribe from the newsletter at any time by sending a message to our contact address indicated in the section "Our Contact Details and Your Rights" or by using the corresponding link in the newsletter. After unsubscribing, we will delete your email address unless you have expressly consented to further use of your data or we reserve the right to further use your data in legally permitted cases, which we inform you about in this privacy policy.

Sending the Newsletter

The newsletter is sent as part of data processing on our behalf by an external service provider. If you have any questions about our service providers and the basis of our cooperation with them, please contact us. Contact details can be found in the section "Our Contact Details and Your Rights."

REVIEWS IN THE ONLINE STORE

If, during or after placing an order, you have given your consent (Art. 6(1)(a) of the GDPR), we will use your email address to send you an electronic invitation to review your purchase in our online store. Reviews are facilitated through the review system we use. You can withdraw your consent at any time by sending an appropriate message to our contact address indicated in the section "Our Contact Details and Your Rights" or by using the corresponding link in the invitation to review.

Customers of the Online Store have the opportunity to voluntarily and free of charge provide a review of their purchases in the Online Store. The review can also include an evaluation, a photo, or a review of the product purchased in the Online Store.

After making purchases in the Online Store, the Seller sends the Customer an email requesting a review along with a link to an online form that allows the review to be submitted – the online form enables answers to the Seller's questions about the purchases, their evaluation, and the addition of a personal description regarding the review and a photo of the purchased product. If no review is provided after the first invitation to review, the Seller will resend the invitation.

The review can only be submitted by a Customer who has made purchases in the Seller's Online Store.

The reviews submitted by the Customer are published by the Seller on the Online Store and on the TrustMate.io profile.

Submitting a review cannot be used by the Customer for unlawful activities, particularly for actions constituting unfair competition towards the Seller, or actions violating personal rights, intellectual property rights, or other rights of the Seller or third parties.

The review can only be submitted for products actually purchased in the Seller's Online Store. It is prohibited to enter fictitious or fraudulent sales contracts for the purpose of submitting a review. The author of the review cannot be the Seller or their employees, regardless of the basis of employment.

The submitted review may be deleted by its author at any time.

6. Cookies and Similar Technologies

General Information

To make your visit to our website more attractive and to enable you to use its key features, we use technological tools, including cookies. Cookies are small text files that are automatically stored on your end device. Some of the cookies we use are deleted after your browser session ends, i.e., after you close your browser (so-called session cookies). Other cookies are stored on your end device and enable us to recognise your browser the next time you visit the site (so-called persistent cookies). We use technologies that are absolutely necessary to ensure the proper and optimal use of essential features of our website (e.g., shopping cart function). These technologies process data such as your IP address, time of visit, device, and browser information, as well as information on the use of our website (e.g., the contents of the shopping cart). This is in accordance with Art. 6(1)(f) of the GDPR to safeguard our legitimate interest in the optimal presentation of our offer.

In addition, we also use technological tools to fulfil legal obligations that apply to us (e.g., to prove consent to process your personal data), as well as for web analytics and online marketing purposes. Further information on this, including the respective legal basis for data processing, can be found in subsequent sections of this privacy policy.

In the help menu of your web browser, you will find explanations on changing cookie settings. These are available under the following links: Microsoft Edge™ / Safari™ / Chrome™ / Firefox™ / Opera™

When you have given us your consent to use specific technological tools (Art. 6(1)(a) of the GDPR), you can withdraw it at any time. To withdraw consent, please contact us via the contact details provided in the section "Our Contact Details and Your Rights."

7. Use of Cookies and Similar Technological Tools for Web Analytics and Marketing Purposes If you have given your consent (Art. 6(1)(a) of the GDPR), we use the following cookies and other similar technological tools from external service providers listed below on our website. After fulfilling the processing purpose and discontinuing the use of the respective technological tool, the data collected through these tools will be deleted. You can withdraw your consent at any time. Detailed information regarding the possibility of withdrawing consent and your right to object can be found under the section "Cookies and Similar Technologies." Further information can be found on the websites of the respective service providers. If you have any questions regarding our service providers and the basis of our cooperation with them, please contact us. You can find our contact details in the section "Our Contact Details and Your Rights."

Use of Google Services
We use the following technological tools from Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Information automatically collected by Google’s technologies regarding your use of our website is generally transmitted to a Google LLC server, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and stored there. The European Commission has not issued an adequacy decision for the USA. Our cooperation is based on the standard data protection clauses adopted by the European Commission. If your IP address is processed using Google’s technological tools, it is anonymized by shortening before being stored on Google's servers. Only in exceptional cases will the full IP address be transmitted to a Google server and shortened there. Unless otherwise specified for the individual Google technologies described in this privacy policy, data processing occurs based on a data co-controller agreement concluded with Google pursuant to Art. 26 GDPR. Further information regarding Google's data processing can be found in Google's privacy policy.

Google Analytics
For the purpose of analysing the use of our website, we use Google Analytics – a web analytics tool provided by Google, which automatically processes your data (IP address, time spent on the website, device and browser information, as well as information about your usage of our website) and creates pseudonymous user profiles. Cookies may be used for this purpose. As a rule, your IP address is not linked with other data collected by Google. Data processing within the framework of Google Analytics is based on a data processing agreement concluded with Google.

To optimize and make our website offering more attractive, we have also activated the data-sharing settings for "Google products and services". This allows Google to access the data collected and processed through Google Analytics and use it to improve Google products and services. The sharing of data with Google for this purpose occurs based on an additional agreement between the data controllers. We have no influence on the subsequent data processing by Google.

Google Ads
We use Google Ads to promote our website in search results and on third-party websites. For this purpose, when you visit our website, a remarketing cookie from Google is automatically stored on your device, which, based on the websites you visit, allows advertisements to be displayed according to your interests by processing your data (IP address, time spent on the website, device and browser information, as well as information about your usage of our website) using a pseudonymous identifier (ID). Further data processing will only occur if you have activated the option for personalized ads in your Google account settings. In such a case, if you are logged in to Google while visiting our website, Google will use your data together with data collected through Google Analytics to create and define so-called target group lists for cross-device remarketing purposes.

For web analytics purposes, we use Google Ads Conversion Tracking to measure and analyse your behaviour if you visit our website via an ad displayed through Google Ads. Cookies may be used for this purpose, and data such as IP address, time spent on the website, device and browser information, and information about your usage of our website, e.g., a visit to the website or registration for a newsletter, may be processed. Pseudonymous user profiles are then created based on this data.

Google Maps
For the visual presentation of geographical information, Google Maps will store and process information regarding how you use maps and individual functions, including your IP address and location data. We have no influence on this data processing by Google.

Google Fonts
To ensure a consistent presentation of content on our websites, a script called "Google Fonts" is integrated into our website, which processes your data (IP address, time spent on the website, device and browser information, as well as information about your usage of our website). We have no influence on this data processing by Google.

Use of Facebook Services
Facebook Pixel
We use the Facebook Pixel tool provided by Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland ("Facebook"). The functionalities of the Facebook Pixel tool that we use are listed below. Facebook Pixel automatically collects and stores data (your IP address, time spent on the website, device and browser information, as well as information about your usage of our website, e.g., a visit to the website or registration for a newsletter). Pseudonymous user profiles are then created based on this data.
For this purpose, when you visit our website, a cookie from Facebook Pixel is stored on your device, which, using a pseudonymous Cookie-ID, automatically recognizes your browser when you visit other websites. Facebook will combine this information with other data from your Facebook account and use it to generate reports on website activity and provide other services related to your use of websites, particularly for personalized advertising purposes. Information automatically collected by Facebook’s technologies regarding your use of our website is generally transmitted to a server of Facebook, Inc., 1601 Willow Road, Menlo Park, California 94025, USA, and stored there. The European Commission has not issued an adequacy decision for the USA. Where data transfer to the USA is our responsibility, our cooperation is based on the standard data protection clauses adopted by the European Commission. Further information on Facebook’s data processing can be found in Facebook's privacy policy.

Facebook Analytics
As part of Facebook Analytics, statistics on user activity on our website are created based on data collected through the Facebook Pixel tool regarding your use of our website. Data processing by Facebook occurs based on a data processing agreement. The analysis of data (website usage statistics) is used to optimize and make our website offering more attractive.

Facebook Ads
Facebook Ads allows us to advertise our website on Facebook and other platforms. We set the parameters for each advertising campaign. Facebook is responsible for the exact execution, particularly the decision on displaying a specific advertisement to individual users. Unless otherwise specified for the individual functions and tools, data processing occurs based on a data co-controller agreement pursuant to Art. 26 GDPR. Shared responsibility is limited to data collection and transmission to Facebook Ireland. This does not include subsequent data processing by Facebook Ireland.
Based on the pseudonymous Cookie-ID stored by Facebook Pixel and the collected information about user activity on our website, we create personalized ads via the Facebook Pixel Remarketing function.
For web analytics purposes and to optimize our offering, we analyse user activity using the Facebook Pixel Conversions function, focusing on those who visit our website through ads displayed through Facebook Ads. Data processing by Facebook occurs based on a data processing agreement.

Integration with Trusted Shops Trustbadge

To display our Trusted Shops Quality Seal, as well as the collected customer reviews and the Trusted Shops offer available to buyers after placing an order, the Trustbadge from Trusted Shops is integrated into our website.
The integration with the Trusted Shops Trustbadge serves our legitimate interests (Art. 6 para. 1 lit. f GDPR) in optimally marketing our offering by enabling secure shopping. The Trustbadge and the services advertised through it are an offer from Trusted Shops GmbH, Subbelrather Str. 15C, 50823 Cologne, Germany. Trusted Shops GmbH uses services from the USA, among others, for this purpose. An appropriate level of data protection is ensured. Further information about data protection principles at Trusted Shops GmbH can be found here.
When the Trustbadge is accessed, the server automatically logs the so-called server logs, which include, e.g., your IP address, date and time of access, the amount of data transmitted, and the requesting internet service provider (access data/server logs) and documents the access. Server logs are stored for the purpose of analyzing security vulnerabilities and are automatically deleted no later than 90 days after their creation. Other personal data is transmitted to Trusted Shops GmbH only if, after placing an order in our shop, you voluntarily decide to use Trusted Shops products or have already registered to use them. In such cases, the contractual agreement between you and Trusted Shops applies. For this purpose, personal data is automatically retrieved from the order data. Whether you, as a buyer, are already registered to use Trusted Shops products is automatically checked based on a neutral parameter – the email address encrypted using cryptographic one-way hashing. The email address is encrypted before being transmitted using a hash value in such a way that it cannot be decrypted by Trusted Shops. After checking for a match, the parameter is automatically deleted. This is necessary to fulfil our and Trusted Shops' legitimate interests (Art. 6. (1)(f) GDPR) in providing services related to each specific order, i.e., Trusted Shops buyer protection (Trusted Shops guarantee) and review services. Further information, including your rights, can be found in the Trusted Shops privacy policy available above and through the Trustbadge tool.

9. Social Media

Social Media Plugins: Facebook, Instagram
Our website uses so-called social media plugins (buttons). These plugins are integrated via an HTML link, ensuring that no automatic, direct connection to the servers of the respective social media provider is established when you visit our website containing such plugins (buttons). Only after clicking on one of the buttons will a new window open in your browser displaying the page of the respective social media platform, where you can confirm the use of the button, e.g., "Like" or "Share."

Our Activity on Social Media Platforms: Facebook, Instagram, YouTube
If you have given your consent to the respective social media platform (Article 6(1)(a) GDPR), your data will automatically be collected and stored for web analytics and marketing purposes when you visit our account/profile on the aforementioned social media platforms. These data are used to create pseudonymised user profiles, which may be used, for example, to display so-called personalised ads within and outside of social media platforms that are likely to match your interests. Cookies are usually used for this purpose.

Detailed information on the processing and use of your data by the respective social media platforms, as well as information about your rights and privacy settings options, and contact details for inquiries, are described in the privacy policies of the respective social media platforms linked below. Should you require assistance in this regard, you can also contact us.

Facebook is a social media service provided by Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland ("Facebook Ireland"). The automatically processed information about your activity and usage of our fan page on Facebook is generally transmitted to and stored on a server of Facebook, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. The European Commission has not issued a decision confirming an adequate level of data protection for the USA. Our cooperation is based on the standard data protection clauses adopted by the European Commission. The processing of data during visits to our Facebook fan page is carried out in accordance with Article 26 GDPR based on the joint controller agreements, which are available here. Further information on the processing of your personal data during visits to the Facebook fan page (page statistics information) can be found here.

Instagram is a social media service provided by Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland ("Facebook Ireland"). The automatically processed information about your activity and usage of our fan page on Instagram is generally transmitted to and stored on a server of Facebook, Inc., 1601 Willow Road, Menlo Park, California 94025, USA. The European Commission has not issued a decision confirming an adequate level of data protection for the USA. Our cooperation is based on the standard data protection clauses adopted by the European Commission. The processing of data during visits to our Instagram fan page is carried out in accordance with Article 26 GDPR based on the joint controller agreements. Further information on the processing of your personal data during visits to the Instagram fan page (page statistics information) can be found here.

YouTube is a social media service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The automatically processed information about your activity and usage of our profile on YouTube is generally transmitted to and stored on a server of Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. The European Commission has not issued a decision confirming an adequate level of data protection for the USA. Our cooperation is based on the standard data protection clauses adopted by the European Commission.

10. Our Contact Details and Your Rights

Individuals whose data are processed have the following rights:

In accordance with Article 15 GDPR: the right to obtain information about the processing of data to the extent specified in that article;
In accordance with Article 16 GDPR: the right to rectify incorrect or incomplete personal data;
In accordance with Article 17 GDPR: the so-called "right to be forgotten," i.e., the right to have your personal data stored by us deleted, provided further processing is not necessary:

to exercise the right to freedom of expression and information;
to fulfil a legal obligation;
for reasons of public interest;
to establish, exercise, or defend legal claims;

In accordance with Article 18 GDPR: the right to restrict the processing of personal data, provided:

the accuracy of the personal data is contested by you;
the processing is unlawful, and you oppose the deletion of the data;
we no longer need the personal data, but you require it to establish, exercise, or defend legal claims;
you have objected to the processing of data in accordance with Article 21 GDPR;

In accordance with Article 20 GDPR: the right to receive the data you have provided to us in a structured, commonly used, and machine-readable format and to transmit those data to another controller;
In accordance with Article 77 GDPR: the right to lodge a complaint with a supervisory authority (the President of the Office for Personal Data Protection, "UODO").

If you have any questions regarding the collection, processing, or use of your personal data, or if you wish to request information, rectification, restriction of processing, or deletion of data, or if you wish to revoke any consents given or object to the use of certain data, please contact the data controller indicated at the beginning of this privacy policy.

Right to Object

If we process your personal data to safeguard our legitimate interests as described in this privacy policy, you may object to the processing of your data for this purpose with effect for the future. If the processing is for direct marketing purposes, you may exercise your right to object at any time. If the processing is for other purposes, you only have the right to object on grounds relating to your particular situation.

Once you have exercised your right to object, we will not continue to process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests and rights, or if the processing serves the establishment, exercise, or defence of legal claims.

The preceding sentence does not apply if the processing is for direct marketing purposes. In this case, once you object, we will always cease further processing of your personal data.