Privacy Policy
We are committed to safeguarding the privacy of our website visitors. This section explains how we collect, use, and protect your personal information when you visit our website and make purchases. This Privacy Policy forms an integral part of our Terms & Conditions.
§ 1 General provisions
- The Controller of the personal data of users of the online shop available under the domain www.my-merino.com is company Vivid Joanna Swaczyna-Wichlińska, entered in the Central Registration and Information on Business of the Republic of Poland with its registered office at: ul. Wrzosowa 24, 95-035 Sokolniki, Tax Id. No: PL7321479949, Business Stat. Number: 472240342 (hereinafter: the “Controller”).
- The Controller has designated an electronic point of contact for direct
communication with Member States’ authorities, the European Commission, and the Digital Services Coordinator:
info@my-merino.com.
The same point of contact may be used by any Customer for direct and prompt communication with the Controller. The Controller may also be contacted in writing at the following address:
My.Merino
ul. Wrzosowa 24,
95-035 Sokolniki,
Poland,
via the contact form available on the website, or by telephone at:
+48 732 625 709 (service hours: 10:00 a.m. – 3:00 p.m. on business days,
call charged as a regular phone call, according to the tariff package of the provider used by the Customer). Communication may be conducted in Polish and English. - The purpose of this Policy is to define the measures undertaken with regard to personal data collected through the Controller’s website and the related services and tools used by its users, as well as in the course of entering into and performing contracts outside the website.
- Where necessary, the provisions of this Policy may be amended. Any change shall be communicated to users by publishing the new content of the Policy, and in the case of a database of persons who have consented to data processing by e-mail or have provided e-mail data when concluding contracts, they will also be notified of the change by e-mail.
§ 2 Legal Basis, Purposes and Retention of Personal Data
- Personal data of users are processed in accordance with the General Data Protection Regulation (GDPR), the Polish Personal Data Protection Act of 10 May 2018, Provision of Electronic Services Act of 18 July 2002, as amended, and for the purpose of submitting notifications pursuant to Article 16(1) of Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market for Digital Services and amending Directive 2000/31/EC (Digital Services Act) (OJ L 277, 27.10.2022, p. 1, as amended; “DSA”), also pursuant to Article 3(h) of the DSA, as well as the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA).
- The Controller may collect the following data for the purposes listed below:
| Purpose of Processing | Legal Basis | Period of Data Retention | Scope of Data |
|---|---|---|---|
| Performance of a contract with the Customer or taking steps at the request of the data subject prior to entering into such a contract | Article 6(1)(b) GDPR (performance of a contract). |
|
|
| Direct marketing |
Article 6(1)(f) GDPR (legitimate interests pursued by the Controller). The Controller may process data for the purpose of direct marketing only after obtaining the data subject’s consent and in the absence of any objection by the data subject. |
|
|
| Marketing | Article 6(1)(a) GDPR (consent) |
|
|
| Customer reviews | Article 6(1)(a) GDPR |
|
|
| Keeping accounting books | Article 6(1)(c) GDPR in connection with Article 86 § 1 of the Tax Ordinance Act of 17 January 2017 or Article 74(2) of the Accounting Act of 30 January 2018. |
|
|
| Processing refunds | Article 6(1)(b) GDPR (Performance of a contract or the undertaking of actions at the request of the data subject prior to the conclusion of a contract) | data are stored for 5 years after termination of business relations with the Customer |
|
| Establishment, exercise or defence of legal claims | Article 6(1)(f) GDPR | data are stored for the period of the legitimate interest but not longer than the limitation period of claims arising from the conducted business activity |
|
| Research and analytics for service improvement | Article 6(1)(f) GDPR |
|
|
| Collection of telemetry data | Article 6(1)(f) GDPR | data are processed until cookie expiry or deletion |
|
| Registration of a Customer Account | Article 6(1)(b) GDPR (Performance of a contract or the undertaking of actions at the request of the data subject prior to the conclusion of a contract) | data are stored for 5 years after termination of business relations with the Customer |
|
| Sending Customer notifications |
Article 6(1)(b) GDPR (Performance of a contract or the undertaking of actions at the request of the data subject prior to the conclusion of a contract) Article 6(1)(c) GDPR (legal obligation) | data are stored for 5 years after termination of business relations with the Customer |
|
| Customer support | Article 6(1)(b) GDPR (Performance of a contract or the undertaking of actions at the request of the data subject prior to the conclusion of a contract) |
|
|
| Proper functioning of the website | Article 6(1)(f) GDPR (Maintaining the performance of the service and its improvement.) | data are stored for 5 years after termination of business relations with the Customer |
|
| Password reset | Article 6(1)(f) GDPR (security of service and Customers) | data are stored for 5 years after termination of business relations with the Customer |
|
| Compliance monitoring with regulations, contracts and this Privacy Policy | Article 6(1)(f) GDPR (security of service and Customers) | data are stored for 5 years after termination of business relations with the Customer |
|
| Handling data subject requests | Article 6(1)(c) GDPR | data are stored for the period of the legitimate interest but not longer than the limitation period of claims arising from the conducted business activity |
|
| Providing information to law enforcement and public authorities | Article 6(1)(c) GDPR | data are stored for the period of the legitimate interest but not longer than the limitation period of claims arising from the conducted business activity |
|
Fulfilment of obligations under Article 16(1),(4),(5) and (6) DSA:
| Article 6(1)(c) GDPR |
Until the notification of:
|
|
| Processing required by proceedings before public authorities including law enforcement. | Article 6(1)(c) GDPR | data are stored for the duration of the legal obligation |
|
- Personal data are retained no longer than necessary to achieve the purpose of processing, i.e. until consent is withdrawn where processing is based on consent, until expiry of the limitation period for claims (in case of contracts for sale or service contracts, two years counting until the end of the calendar year), or until completion of the inquiry sent by e-mail or complaint procedure. After expiry of these periods, personal data will be processed under Article 6(1)(f) GDPR for the purposes arising from legitimate interests pursued in marketing campaigns.
- The Controller may use profiling for the purposes of direct marketing; however, any decisions made on the basis of such profiling by the Controller shall not affect the conclusion or refusal to conclude a contract, nor the possibility of using electronic services. The effects of profiling may include, for example, granting a discount to a given individual, sending a discount code, reminding about unfinished purchases, suggesting a product that may correspond to the individual’s interests or preferences, or offering more favorable conditions compared to the standard offer. Notwithstanding profiling, the individual retains full discretion as to whether they wish to use the received discount or more favorable conditions and make a purchase. Profiling consists of the automatic analysis or prediction of an individual’s behavior on the Controller’s website, e.g., by adding a specific product to the shopping cart, viewing a particular product page, or analyzing the individual’s previous activity on the website. The precondition for such profiling is that the Controller holds personal data of the individual in order to, for example, send them a discount code.
- To the extent necessary for the proper functioning of the website and its features, the website may, during the User’s use of the site, collect other information, including but not limited to:
- IP address,
- Device, hardware, and software information, such as hardware identifiers, mobile device identifiers (e.g., Apple Identifier for Advertising [“IDFA”] or Advertising ID on Android devices [“AAID”]),
- Platform type,
- Settings and components,
- Web browser information, including browser type and preferred language.
- Taking into account the nature, scope, context, and purposes of processing, as well as the risks to the rights and freedoms of natural persons of varying likelihood and severity, the Controller implements appropriate technical and organizational measures to ensure that processing is carried out in accordance with the Regulation and to be able to demonstrate such compliance. These measures are reviewed and updated as necessary. The Controller applies technical measures to prevent unauthorized access to or modification of personal data transmitted electronically.
§ 3 Data Disclosure
- The Collector ensures that all collected personal data are used solely for the fulfillment of obligations toward the Users. Such information shall not be disclosed to third parties, except in the following cases:
- Where the data subjects have given their explicit prior consent to such disclosure; or
- Where the obligation to provide such data arises or will arise from applicable law, e.g., to law enforcement authorities.
- Additionally, the personal data of users and clients may be disclosed to the following recipients or categories of recipients:
- Service providers supplying the Collector with technical, IT, and organizational solutions enabling the Collector to conduct business, including the website and electronic services provided through it (in particular, software providers, marketing agencies, email and hosting providers, providers of software for company management and technical support to the Collector, as well as product delivery operators) – The Collector discloses the collected personal data of the Client to a selected service provider acting on its behalf only to the extent and for the purpose necessary to achieve the specific processing objective in accordance with this Privacy Policy.
- Service providers supplying the Collector with accounting, legal, and advisory services (in particular, accounting offices, law firms, or debt collection companies) – The Collector discloses the collected personal data of the Client to a selected service provider acting on its behalf only to the extent and for the purpose necessary to achieve the specific processing objective in accordance with this Privacy Policy.
- Service provides supplying the Collector with payment gateways and payment processing solutions – The Collector discloses the collected personal data of the Client to a selected service provider acting on its behalf only to the extent and for the purpose necessary to achieve the specific processing objective in accordance with this Privacy Policy. In the case of the Collector’s business activities, such a service is provided by:
- Przelewy24 – PayPro SA, with its registered office in Poznań, at 8 Pastelowa Street (60-198), registered in the Register of Entrepreneurs of the National Court Register maintained by the District Court Poznań – Nowe Miasto and Wilda, 8th Commercial Division of the National Court Register under KRS: 0000347935, NIP (Tax Identification Number): 7792369887, a share capital of PLN 4,737,100.00 fully paid-up, and registered in the register of domestic payment institutions maintained by the Polish Financial Supervision Authority under number UKNF IP24/2014;
- Klarna – Klarna Bank AB, with its registered office in Stockholm, at Sveavägen 46, SE-111 34 Stockholm, registered in the Swedish Companies Registration Office (Bolagsverket) under organization number 556737-0431, VAT number SE556737043101, authorized to conduct banking activities and supervised by the Swedish Financial Supervisory Authority (Finansinspektionen); provides services in other EEA countries under license passporting. The Polish branch, Klarna Poland sp. z o.o., located at 20 Prosta Street, 00-850 Warsaw, is registered in the Register of Entrepreneurs under KRS: 0000907691, NIP: 5272965530, REGON: 38956712, with a share capital of PLN 5,000.00;
- PayPal – PayPal Holdings, Inc., with its registered office at 2211 North First Street, San Jose, California, 95131, USA, incorporated in the State of Delaware — identification number (EIN) 77-0510487; supervised by U.S. regulatory authorities and holding Money Transmitter Licenses. The Polish branch, PayPal Polska sp. z o.o., located at 53 Emilii Plater Street, 00-113 Warsaw, Poland, is registered in the Register of Entrepreneurs under KRS: 0000289372, NIP: 5252406419, REGON: 141108225, with a share capital of PLN 506,500.00.
- Service provides supplying the Collector with courier services – The Collector discloses the collected personal data of the Client to a selected service provider acting on its behalf only to the extent and for the purpose necessary to achieve the specific processing objective in accordance with this Privacy Policy.
- The Collector may disclose anonymized data (i.e., data that do not identify specific Users) to external service providers in order to better assess the attractiveness of advertisements and services for Users. To this end, and due to the location of the software providers, such data may be transferred – while ensuring their protection – to third countries, provided that these countries either ensure the standard contractual clauses approved by the European Commission for personal data processing or have appropriate authorization to do so under bilateral data processing agreements between the European Union and the respective third country, which is not a member of the European Economic Area. In the case of the Collector’s business activities, such a service is provided by:
- Google LLC (registered office: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) – provider of tools such as Google Analytics, Google Tag Manager, Google Ads, Google Workspace (including Google Drive, Gmail, Google Sheets, Google Forms, Google Looker Studio);
- Meta Platforms Ireland Limited (registered office: 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, D02 X525, Ireland) – provider of tools such as Meta Pixel, Meta Ads, Meta Business Suite, Instagram, Facebook;
- LinkedIn Ireland Unlimited Company (registered office: Wilton Place, Dublin 2, Ireland) – provider of tools such as LinkedIn Ads, LinkedIn Insight Tag, LinkedIn Campaign Manager;
- Hosting service provider – for the purposes of analytical tools used to analyse website traffic statistics and track user activities on the website.
- The Collector always informs of the intention to transfer personal data outside the EEA at the stage of data collection.
- The Collector continuously conducts risk assessments to ensure that personal data are processed securely – primarily ensuring that access to the data is granted only to authorized persons and solely to the extent necessary for the performance of their duties. The Collector ensures that all operations on personal data are recorded and performed only by authorized employees and collaborators.
- The Collector takes all necessary measures to ensure that its subcontractors and other cooperating entities also provide guarantees of implementing appropriate security measures whenever they process personal data on behalf of the Collector.
- The Collector’s website may use the functionality of Google Analytics, a web traffic analysis service provided by Google LLC (“Google”). Google Analytics uses cookies to help website operators analyze how visitors use the site. Information generated by the cookies about the use of the website by visitors is generally transmitted to Google and stored on servers in the United States. According to current IT standards, the IP addresses of users visiting the Collector’s website are anonymized. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and anonymized there. On behalf of the Collector, Google will use this information to evaluate the website for its users, prepare reports on website traffic, and provide other services related to website traffic and Internet usage for website operators. Google will not associate the IP address transmitted via Google Analytics with any other data held by Google. More information about how Google Analytics collects and uses data can be found on Google’s official website: www.google.com/policies/privacy/partners. Furthermore, each User may prevent the collection and processing of data regarding their use of the website by Google by downloading and installing the browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout.
- When disclosing data to third parties, the Collector makes every effort to ensure that this is done only to entities that meet the criteria and requirements specified under Articles 46 or 49 of the GDPR. Where appropriate, the Collector relies on the EU standard contractual clauses and other safeguards to enable transfers outside the EEA. In accordance with the ruling of the Court of Justice of the European Union of 16 July 2020, the Collector continues to assess the legal system of the countries to which data are transferred and, where necessary, updates measures to ensure an adequate level of protection.
- With respect to data transferred to the United States, when disclosing data to third parties, the Collector makes every effort to ensure that such transfers are made only to entities and organizations in the U.S. that comply with the new “EU–US Data Privacy Framework,” in accordance with the European Commission’s decision of 10 July 2023. The list of these organizations has been published by the U.S. Department of Commerce. Transfers of personal data from the EEA to organizations that have joined the “EU–US Data Privacy Framework” and are included on this list may take place without the need for additional authorizations or the use of legal instruments such as standard contractual clauses or binding corporate rules. However, if a given data importer in the U.S. has not joined the “EU–US Data Privacy Framework,” the transfer of personal data to such an entity is possible only in compliance with the conditions set out in Articles 46 or 49 of the GDPR. In such cases, the Collector will rely on EU standard contractual clauses and other safeguards to enable transfers outside the EEA.
§ 4 User Rights
- The User whose personal data are being processed has the right to:
- Access, rectification, restriction, erasure, or data portability – the data subject has the right to request from the Collector access to their personal data, rectification, erasure (“the right to be forgotten”), or restriction of processing, as well as the right to object to processing and the right to data portability. The detailed conditions for exercising these rights are specified in Articles 15–21 of the GDPR.
- Withdrawal of consent at any time – the data subject whose personal data are processed by the Collector on the basis of consent (pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR) has the right to withdraw their consent at any time, without affecting the lawfulness of processing carried out based on the consent prior to its withdrawal.
- Lodging a complaint with a supervisory authority – a data subject has the right to lodge a complaint with a supervisory authority in the manner and procedure specified in the GDPR and Polish law, in particular the Personal Data Protection Act. The supervisory authority in Poland is the President of the Personal Data Protection Office in Warsaw.
- Right to object – a data subject has the right to object at any time – for reasons related to their particular situation – to the processing of their personal data based on Article 6(1)(e) (public interest or official authority) or Article 6(1)(f) (legitimate interests of the Collector), including profiling based on these provisions. In such a case, the Collector may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject, or grounds for the establishment, exercise, or defense of legal claims.
- Right to object to direct marketing – if personal data are processed for the purposes of direct marketing (based on the legitimate interest of the Collector, not on the data subject’s consent), the data subject has the right to object at any time to the processing of their personal data for such marketing purposes, including profiling, to the extent that the processing is related to direct marketing.
- Exercising the above rights is carried out on the basis of a request submitted by the User to the following email address: info@my-merino.com Such a request should include the User’s full name.
- The User represents and warrants that the data they provide or publish on the website are accurate.
§ 5 Cookies
- For the purposes of this Policy, “cookies” shall mean IT data, in particular text files, stored on Users’ end devices (typically on a computer hard drive or a mobile device), used by the User’s browser to save certain settings and data necessary for the use of websites. Such files make it possible to recognize the User’s device and properly display the website, thereby ensuring a convenient browsing experience. The storage of cookies allows the website and its offerings to be tailored to the User’s preferences — the server recognizes the User and remembers, among other things, preferences such as visits, clicks, and previous actions.
- “Cookies” contain, in particular, the domain name of the website from which they originate, the period for which they are stored on the end device, and a unique number used to identify the browser from which the connection to the website is established.
- Cookies are used for the following purposes:
- to tailor the content of websites to the User’s preferences and to optimize the use of websites;
- to create anonymous statistics that, by helping to determine how Users interact with websites, enable the improvement of their structure and content;
- to deliver advertising content to Users that is tailored to their interests. Cookies are not used to identify the User, and no User’s identity is determined on the basis of cookies.
- The primary classification of “cookies” consists of their distinction into the following categories:
- Essential Cookies – these cookies are strictly necessary for the proper functioning of the website or the functionalities that the User wishes to use. Without them, many of the services we offer could not be provided. Some of these cookies also ensure the security of services that we provide electronically.
- Functional Cookies – these cookies are important for the operation of the website because:
- they enhance the functionality of the website; without them, the website will still operate correctly but will not be customized to the User’s preferences,
- they ensure a high level of website functionality; without them, the functionality of the website may be reduced, although their absence should not entirely prevent its use,
- they support most of the website’s functionalities; blocking them will result in certain features not functioning properly.
- Business Cookies – these cookies enable the implementation of the business model on the basis of which the website is made available. Blocking these cookies will not render the entire functionality of the website unavailable, but it may reduce the level of service provided due to the inability of the website owner to generate revenue subsidizing the operation of the website. This category includes, for example, advertising cookies.
- Configuration Cookies – these cookies enable the configuration of functions and services on websites.
- Security and Reliability Cookies – these cookies allow the verification of authenticity and optimization of website performance.
- Authentication Cookies – these cookies enable the website to inform when the User is logged in, allowing the website to display appropriate information and functionalities.
- Session State Cookies – these cookies store information about how Users interact with the website. They may relate to the most frequently visited pages or any error messages displayed on certain pages. Cookies used to store the so-called “session state” help improve services and enhance the browsing experience.
- Process Cookies – these cookies enable the efficient functioning of the website and the features available on it.
- Advertising Cookies – these cookies allow the display of advertisements that are more relevant to Users and more valuable to publishers and advertisers. They may also be used to personalize advertisements as well as to display ads outside of the website.
- Location Access Cookies – these cookies enable the customization of displayed information according to the User’s location.
- Analytics, Research, and Audience Measurement Cookies – these cookies enable website owners to better understand their Users’ preferences and, through analysis, improve and develop products and services. Typically, the website owner or a research company collects information anonymously and processes data regarding trends without identifying the personal data of individual Users.
- The use of cookies to tailor website content to the User’s preferences does not, as a rule, involve the collection of any information that would allow the identification of the User, although such information may occasionally constitute personal data, i.e., data that can link certain behaviors to a specific User. Personal data collected through the use of cookies may be gathered solely for the purpose of performing specific functions on behalf of the User. Such data are encrypted in a manner that prevents access by unauthorized persons.
- The cookies used by this website are not harmful to the User or to the end device they are using. Therefore, for the proper functioning of the website, it is recommended not to disable cookies in the browser. In many cases, web browsing software (web browsers) allows, by default, the storage of information in the form of cookies and other similar technologies on the user’s end device. The User may change how cookies are handled by their browser at any time. To do so, the browser settings must be adjusted. The method for changing these settings varies depending on the browser being used. Relevant instructions can be found on the support pages corresponding to the browser in use.
- Cookies are also used to facilitate logging into the User’s account, including via social media, and to allow navigation between subpages on the website without the need to log in again on each subpage. At the same time, cookies are used to secure the website, for example, by preventing access by unauthorized persons.
- As part of cookie technology, the Collector may use tracking pixels or clear GIF files to collect information about how users use its services and their responses to marketing messages sent by email. A pixel is a software code that allows embedding an object—usually a one-pixel image—on a website, which enables tracking of Users’ behavior on the web pages where it is placed. Upon giving the appropriate consent, the browser automatically establishes a direct connection with the server storing the pixel; therefore, the processing of data collected by the pixel is carried out in accordance with the data protection policy of the partner managing the server.
- The Collector may use web log files (which contain technical data, such as the User’s IP address) to monitor traffic within its services, troubleshoot technical issues, detect and prevent fraud, and enforce the provisions of the User contract.
- The Collector informs that the website does not respond to Do Not Track (DNT) signals. However, the User may disable certain forms of online tracking, including some analytics data and personalized advertisements, by adjusting the cookie settings in their browser or by using our cookie consent management tools (if applicable).
- Detailed information on how to change cookie settings and manually delete cookies in the most popular web browsers is available in the browser’s help section and on the following websites (simply click on the respective link):
- Detailed information on managing cookies on a mobile phone or other mobile device can be found in the user manual of the respective mobile device.
This Privacy Policy have been prepared by the Law Firm RPMS Staniszewski & Partners for my-merino.com store administrator and are protected by law. Copying or distributing the text without the consent of the entitled parties is prohibited.