Privacy Policy – RAIOS Maria Klar

PL / EN

raiosobjects.com

§ 1. General Provisions

This Privacy and Cookies Policy (hereinafter: “Policy”) sets out the rules for processing and protecting personal data, as well as the use of cookies and similar technologies in connection with the use of the website available at https://raiosobjects.com/ (hereinafter: “Website”).
The controller of personal data is Maria Klar (hereinafter: “Controller”). The Controller can be contacted at the following email address: maria@raiosobjects.com.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
The Website is operated using the WordPress content management system together with e-commerce software (WooCommerce plugin). Data is stored on the servers of the hosting service provider, with whom the Controller has entered into a data processing agreement.

§ 2. Definitions

Terms used in this Policy shall mean:

User – any natural person using the Website, including persons making purchases or contacting the Controller;
Website / Shop – the website at raiosobjects.com;
Form – a functionality enabling the entry of personal data, in particular for the purpose of placing an order or making contact;
Cookies – digital data, in particular small text files, saved and stored on the User’s end device.

§ 3. Purposes and Legal Bases for Data Processing

The User’s personal data may be processed for the following purposes and on the following legal bases:

a) conclusion and performance of a sales contract, including order fulfilment and delivery – Art. 6(1)(b) GDPR;
b) fulfilment of obligations arising from legal provisions, in particular tax and accounting obligations, including issuing a receipt – Art. 6(1)(c) GDPR;
c) handling complaints and processing contract withdrawals – Art. 6(1)(b) and (c) GDPR;
d) handling enquiries submitted via the contact Form, email, or Instagram (including via the ManyChat tool) – Art. 6(1)(f) GDPR (the Controller’s legitimate interest in communicating with the User);
e) establishing, pursuing, or defending against claims – Art. 6(1)(f) GDPR;
f) maintaining statistics and analysing Website traffic – Art. 6(1)(f) GDPR, and to the extent requiring access to information stored on the User’s end device – on the basis of consent (Art. 6(1)(a) GDPR in conjunction with Art. 398 of the Electronic Communications Law);
g) direct marketing, including sending commercial communications and notifications – on the basis of consent (Art. 6(1)(a) GDPR in conjunction with Art. 398 of the Act of 12 July 2024 – Electronic Communications Law);
h) publication of a review submitted by the User – Art. 6(1)(a) GDPR (consent).

§ 4. Scope of Data and Voluntary Nature of Provision

The Controller processes data provided by the User, in particular first and last name, delivery address, email address, phone number, and – if a receipt is requested – data necessary for its issuance.
Providing data is voluntary, but necessary for the conclusion and performance of a contract, handling an enquiry, or fulfilling the other stated purposes. Failure to provide data makes it impossible to fulfil the given purpose.

§ 5. Recipients of Data

The User’s personal data may be transferred to the following categories of recipients, acting under data processing agreements or as independent controllers:

a) Website hosting service providers;
b) payment operators: Stripe Payments Europe, Ltd. (handling Stripe payments, including card payments and BLIK);
c) delivery providers: InPost S.A. and postal and courier operators;
d) the provider of the ManyChat communication automation tool – in relation to handling communications via Instagram;
e) social media service providers: Meta Platforms Ireland Ltd. (Instagram, Facebook);
f) entities providing accounting, legal, or IT services to the Controller;
g) public authorities – to the extent required by law.

§ 6. Transfer of Data Outside the European Economic Area

Some data recipients (e.g. providers of social media or marketing tools) may process data outside the European Economic Area. In such cases, data transfer takes place on the basis of a European Commission adequacy decision or standard contractual clauses referred to in Art. 46 GDPR.

§ 7. Data Retention Period

Personal data is stored for the period of:

a) performance of the contract and the limitation period for related claims;
b) required by law, in particular tax law – with respect to accounting documents;
c) until an effective objection is raised – with respect to data processed on the basis of the Controller’s legitimate interest;
d) until consent is withdrawn – with respect to data processed on the basis of consent.

§ 8. User Rights

The User has the rights set out in Art. 15–22 GDPR, namely the right to access data, rectify it, erase it, restrict processing, data portability, and the right to object to processing.
With respect to data processed on the basis of consent, the User may withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
The User has the right to lodge a complaint with the President of the Personal Data Protection Office.

§ 9. Forms and Contact

Order form – enables placing an order; data necessary for its fulfilment is processed.
Contact form and contact via email or Instagram – enables communication with the Controller; data provided in the message content is processed.

§ 10. Social Media Profiles and Sales via Instagram

The Controller maintains profiles on Instagram and Facebook. In connection with their operation, data of persons interacting with the profile may be processed by the Controller and by Meta Platforms Ireland Ltd. as joint controllers within the meaning of Art. 26 GDPR – in relation to statistics; detailed rules are set out in the service provider’s terms.
Where communication and sales are conducted via Instagram, the Controller may use the ManyChat tool for message automation. This tool processes data contained in the User’s messages for the purpose of handling enquiries and fulfilling orders. The Controller has no influence over the data processing rules applied by the Instagram service provider under its own privacy policy.

§ 11. Cookies

The Website uses both first-party and third-party cookies.
Cookies are used to ensure the proper functioning of the Website and Shop (including the shopping cart and order process), to maintain statistics, and – with the User’s consent – for marketing purposes.
The following types of cookies are distinguished:
- a) necessary – required for the Website to function properly; their use does not require the User’s consent;
- b) analytical and marketing – used only upon the User’s consent.
The Website may use third-party tools, in particular analytical and marketing tools (e.g. Google Analytics, Meta tools) and abandoned cart recovery functions – to the extent and on the terms indicated in the consent management mechanism.

§ 12. Cookie Consent and Settings Management

On their first visit to the Website, the User is informed about the use of cookies and asked to consent to cookies other than necessary ones; consent is voluntary and may be withdrawn at any time.
The storing of non-essential cookies and accessing information already stored on the User’s end device takes place on the basis of the User’s consent, in accordance with Art. 398 of the Act of 12 July 2024 – Electronic Communications Law (Journal of Laws of 2024, item 1221).
The User may at any time change their cookie settings via their web browser settings or through the consent management mechanism available on the Website. Restricting the use of cookies may affect certain Website functionalities.

§ 13. Final Provisions

Publication date: 28 June 2026.

Matters not regulated by this Policy shall be governed by the GDPR and other generally applicable laws.

The Controller may update this Policy; the current version is published on the Website at all times.