Provision of personal data is voluntary and at the same time conditions, among others, to take action before concluding a contract. Personal data will be processed for the necessary period of no more than 6 years, and everyone has the right to rectify, delete, limit processing, object to processing, and transfer the data. Any data subject may file a complaint with a supervisory authority. In the case of an inquiry to Alfa Forwarding Ltd, sp. z o.o., the controller of personal data is Alfa Forwarding Ltd, sp. z o.o., Tadeusza Wendy 7/9, 81-341 Gdynia, NIP: 586-02-03-656, while in the case of an inquiry to Alfa Agencja Celna sp. z o. o., the controller of personal data is Alfa Agencja Celna sp. z o. o. Tadeusza Wendy 7/9, 81-341 Gdynia, NIP: 958-14-66-815

§1 Identity of data administrator

  1. The administrator of personal data provided during the use of the Service operated under the name alfaforwarding.pl (ALFA FORWARDING LTD. Sp. z o.o. ul. Podolska 21, 81-321 Gdynia, NIP: 5860203656, REGON: 190314596, KRS: 0000077114).
  2. Data is processed in accordance with currently applicable laws; i.e. Regulation 2016/679 of the European Parliament and of the Council of the EU of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter: RODO), the Data Protection Act of May 10, 2018, as well as the Act of July 18, 2002 on the provision of electronic services.
  3. The following Privacy Policy covers the rules for the processing of data of Site Users, as well as of persons entering into contracts with the Data Controller, including those related to the execution of an Order in the Online Store, as well as data collected through contact with the Data Controller (email address or telephone) or traditional correspondence, as well as of persons who like and/or observe the Administrator’s fanpage on social media, if it conducts.

§2 Definitions used

  1. The following definitions are used in this policy:
    1. Service– the Internet service available at alfaforwarding.pl through which the User may: browse its content, contact the data controller (contact form).
    2. Personal data controller – the entity that decides on the purpose and means of data processing, in this policy it is understood as: ALFA FORWARDING LTD. Sp.zo.o. ul.Podolska 21, 81-321 Gdynia.
    3. User – a natural person to whom the data pertains and who uses the services available on the Website/Store.
    4. Personal data – any information that, without excessive time and cost, can lead to the identification of an individual, including his/her identification, address and contact data.

§3 Purposes of personal data processing

  1. The Personal Data Administrator processes personal data only when permitted by currently applicable laws, including for the purpose of:
    1. taking action at the request of the data subject, including responding to inquiries made via electronic means of communication or for the purpose of handling traditional correspondence, and this processing is carried out on the basis of Article 6(1)(b) of the RODO,
    2. sending ordered marketing information by electronic means (newsletter) to the e-mail address provided by the User for this purpose, and this processing takes place on the basis of Article 6(1)(a) RODO, i.e. the consent of the data subject,
  2. to market the Controller’s own products and services by traditional means, on the basis of Article 6(1)(f) RODO, i.e. in order to realize the legitimate interests of the Controller or the data subject,
    1. to send an email requesting an evaluation of the Store and/or the Goods/Product is done on the basis of Article 6(1)(f) RODO, and this processing is done for the legitimate purpose of the data controller (Seller), which is to improve the offer and/or the Goods/Product and/or the Store by collecting reliable opinions about them by the owner of the Store,
    2. to send a request for an opinion on the services and goods/products of the Data Controller through external satisfaction survey services such as [e.g. Opineo, Ceneo, etc.,.] with the consent of the data subject, i.e. on the basis of Article 6(1)(a) of the RODO, [note: sending a request for an opinion directly from the Seller/Business owner to the customer is done on a different basis than the customer’s use of satisfaction survey services].
    3. the assertion of rights and claims by the Data Controller or the data subject, on the basis of Article 6(1)(f) RODO and is done for a legitimate purpose.
  3. The provision of personal data is necessary for the performance of a distance contract, including the shipment of goods or the provision of a digital product and the issuance of an accounting document, the assertion of claims, and the answering of questions. Provision of personal data in other respects is voluntary.
  4. Failure to provide the required data makes it impossible to execute a distance contract, issue a bill or invoice, or make contact at the request of the data subject.

§4 Ways of obtaining data

  1. The User’s personal data is collected directly from the data subjects, i.e. by:
    1. filling out a form with contact information when submitting an inquiry via a form on the site,
    2. filling out a newsletter subscription form,
    3. filling out an order form in the shop-online,
    4. registering an account on the Site,
    5. providing data to prepare and conclude a contract,
    6. direct contact with the data controller using the contact details available on the site or in traditional form at the place of business.

§5 Scope of processed data

  1. The scope of processed personal data has been limited to the minimum necessary to provide services in terms of:
    1. submitting an inquiry through the contact form or by means of contact data available on the site: e-mail address telephone number, e-mail address, first name, any other data voluntarily provided by the data subject,
    2. making a subscription to the newsletter: first name, e-mail address,
    3. placing an order in the online store: first and last name, e-mail address, telephone number, delivery address, possible address of the collection point,
    4. registration of an account on the Website or online store: first and last name, e-mail address, password, login,
    5. issuing a bill or invoice: name and surname or name of the entity, registered office address, tax ID number,
    6. preparation and conclusion of a contract: name, address, ID card number, etc.

§6 Period of data processing

  1. The period of data processing depends on the purpose for which the data were collected and is for:
    1. concluding and executing a contract of sale, including distance sales – for the period necessary to document the executed contract, including the issuance of a bill or invoice – 5 years, counting from the end of the calendar year in which the deadline for tax payment expired, pursuant to Article 112 of the Law of March 11, 2004 on tax on goods and services, in connection with Article 70 of the Law of August 29, 1997. – Tax Ordinance,
    2. for the purpose of sending commercial information by electronic means (newsletter) and/or setting up an Account in the Store/submitting a request for opinion by external satisfaction survey services – until the consent is revoked, without affecting the compatibility of the processing performed before its revocation,
    3. for the period necessary to answer the question asked via the contact form or by phone, but no longer than for 6 months, unless the person decides to conclude a contract with the Personal Data Administrator,
    4. for the purpose of asserting claims, pursuant to the Act under Article 118 of the Act of April 23, 1964. – Civil Code. Unless a special provision provides otherwise, the statute of limitations is six years, and for claims for periodic benefits and claims related to the conduct of business – three years.

§7 Recipients of data

  1. The User’s personal data may be entrusted to other entities for the purpose of performing services on behalf of the data controller, in particular to entities in the field of:
    1. servicing and maintaining the IT systems in which the data is processed, including for newsletter automation, invoicing, order processing, etc,
    2. providing accounting services,
    3. maintenance of office services,
    4. courier service broker,
    5. dropshipping and/or order logistics processing.
  2. User’s personal data may also be shared with entities supporting the data controller, including entities providing courier and postal services, online payment processing.
  3. User’s personal data is not transferred to third countries or international organizations.
  4. Personal data may be processed outside the European Economic Area in a so-called third country, in particular in the United States of America in connection with the Administrator’s use of IT solutions whose servers are located outside the European Economic Area. The basis for data processing in third countries will be the European Commission’s Decision 2021/914 on standard contractual clauses for the transfer of personal data to third countries. The data controller and service provider will provide the highest guarantees for the protection of the entrusted data. Data processing will not violate the privacy of individuals.

§8 Controller’s Fanpage on social media

  1. The Data Controller is also at the same time the co-controllers of the data of its observers in social media – especially those who use electronic means of communication on the fanpage – Facebook
  2. For the rest, the controller of the data of Users of these social media sites is Meta Platforms Ireland Limited (formerly: Facebook Inc., headquartered at 1 Hacker Way, Menlo Park, CA 94025, USA), and the processing of this data is carried out in accordance with the rules described in the regulations and privacy policies of the users of these sites, including at: https://www.facebook.com/privacy
  3. Personal data of the User who likes and/or observes the Administrator’s fanpage on social media will be processed outside the European Economic Area in a so-called third country, in particular in the United States of America in connection with the use of IT solutions whose servers are located outside the European Economic Area.
  4. The basis for processing in third countries will be the European Commission’s Decision 2021/914 on standard contractual clauses for the transfer of personal data to third countries. The data controller and service provider will provide the highest guarantees for the protection of the entrusted data. Data processing will not violate the privacy of individuals.

§9 Rights of data subjects

  1. Data subjects have the right to:
    • to access the content of personal data, including to receive a first copy of the content of personal data free of charge,
    • to correct the data,
    • The right to erasure of data, unless other laws are in force that oblige the data controller to archive data for a specific period of time,
    • The right to data portability, insofar as the basis for data processing is a contract or the consent of the data subject, and data processing is carried out by automated means,
    • to revoke consent to the processing of personal data – if the basis for such processing was the consent of the data subject. Revocation of consent does not affect the compliance of the processing that was carried out before its withdrawal,
    • to object to the processing of data – on grounds related to the particular situation to the processing of personal data concerning him/her based on Article 6(1)(e) or (f) of the RODO, as well as the right to restrict processing,
    • The right not to be subject to automated profiling, if the controller would make decisions based solely on automated profiling with legal consequences for the data subject or similarly affected,
    • The right to control the processing of data and to be informed about who the data controller is, as well as to obtain information about the purpose, scope and manner of data processing, the content of the data, the source of the data, and the manner of sharing, including the recipients or categories of recipients of the data,
  2. In order to exercise the right to information, access to the content of the data, correction of the data, as well as other rights, the Data Controller may be contacted.
  3. The data subject also has the right to lodge a complaint with the Office for Personal Data Protection (OPA) if the processing of data violates the provisions of the General Data Protection Regulation (GDPR). The complaint may be filed electronically or by mail to: Office for Personal Data Protection, 2 Stawki Street, 00-193 Warsaw.

§10 Final provisions

In the event of changes to the applicable privacy policy, in particular if required by the technical solutions used or changes in the law regarding the privacy of data subjects, appropriate modifications to this Privacy Policy will be made, which will be effective within 14 days of their publication on the Website/Store.