Privacy and Cookies Policy

Privacy and cookies policy

Data Controller and definitions
- The controller of the personal data of the Customers / Users of the Online Store, also referred to as the Seller, is: TOYA S.A., phone: +48 71 32 46 330, NIP: 8951686107, REGON: 932093253.
- The Data Controller can be contacted:
  - at the mailing address: Sołtysowicka 13-15, 51-168 Wrocław;
  - at email address: iod@yato.pl
- User - a natural person accessing the website/pages of the Online Store or using the services or functionalities described in this Privacy and Cookies Policy.
- Customer - a natural person with full legal capacity, a natural person who is a Consumer, a legal person or an organisational unit without legal personality, which is granted legal capacity by law, who concludes a Distance Sales Contract with the Seller.
- Online Store - a website operated by the Seller, available at the electronic address (site): https://toya24.pl/ through which the Customer/User may obtain information about the Goods and their availability and purchase the Goods or order the provision of services.
- Newsletter - information, including commercial information within the meaning of the Act of 18 July 2002 on Provision of Electronic Services (Polish Journal of Laws of 2020, item 344) from the Seller sent to the Customer/User electronically; its receipt is voluntary and requires the consent of the Customer/User.
- Account - a set of data stored in the Online Store and in the Seller’s ICT system relating to a given Customer/User and the orders they place and contracts they conclude, using which the Customer/User can place orders and conclude contracts.
- GDPR - Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Purposes, legal basis and duration of data processing
- In order to perform the sales contract or provide electronic services, the Controller may process:
  - information about the User’s device in order to ensure the correct operation of the services: the IP address of the computer, information contained in cookies or other similar technologies, session data, browser data, device data, data on activity on the Site, including on individual subpages;
  - geolocation information, if the User has consented to the Service Provider’s access to geolocation. Geolocation information is used to provide more customised product and service offers;
  - Users’ personal data: name, surname, registered office address, mailing address, e-mail address, telephone number, NIP [tax identification number], bank account number, or other personal data required by the Controller in the purchase process.
- The information indicated in Section 1(1) and (2) above does not contain data concerning the identity of Users, but in combination with other information may constitute personal data and, therefore, the Controller covers it with the full protection afforded under the GDPR.
- These data are processed in accordance with Article 6(1)(b) of the GDPR, for the purpose of performing a service, i.e. a contract for the provision of electronic services in accordance with the Regulations or the performance of a concluded sales contract, and in accordance with Article 6(1)(a) of the GDPR, in connection with the consent to the use of certain cookies or other similar technologies, expressed by the relevant settings of the web browser in accordance with the Telecommunications Law, or in connection with the consent to geolocation. The data are processed until the Customer/User’s use of the Online Store is terminated.
- The Controller undertakes to take all measures required under Article 32 of the GDPR, i.e., taking into account the state of the art, the cost of implementation and the nature, scope and purposes of the processing and the risk of violation of the rights or freedoms of natural persons of varying probability and severity, the Controller shall implement appropriate technical and organisational measures to ensure a degree of security appropriate to the risk.
Marketing activities of the Controller
- On the website of the Online Store, the Data Controller may post marketing information about its products or services. The display of this content is carried out by the Data Controller in accordance with Article 6(1)(f) of the GDPR, i.e. in accordance with the Data Controller’s legitimate interest in publishing content related to the services provided and promotional content of campaigns in which the Data Controller is involved. At the same time, this action does not violate the rights and freedoms of Customers/Users; Customers/Users expect to receive similar content, and even expect it, or it is their direct purpose of visiting the website/pages of the Online Store.
Recipients of user data
- The Data Controller shall disclose Users’ personal data only to processors under concluded personal data processing agreements for the purpose of performing services for the Data Controller, e.g. hosting and operating the Website, IT services, marketing and PR services.
- In order to properly perform the Distance Sales Contract, the Data Controller may share Customers/Users’ data with courier companies. The currently available delivery methods in the Online Store are available at: https://toya24.pl/eng-delivery.html.
- In order to properly perform the Distance Sales Contract, the Controller may share Customers/Users’ data with internet payment systems. The currently available prepaid payment methods in the Online Store are available at: https://toya24.pl/eng-payments.html.
Transmission of personal data to third countries
- Personal data shall not be processed in third countries.
Rights of Data Subjects
- Every data subject has the right:
  - to access (Article 15 of the GDPR) - to obtain confirmation from the Data Controller as to whether its personal data are being processed. If data of a person are processed, they are entitled to access it and obtain the following information: the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the data have been or will be disclosed, the period of data retention or the criteria for determining it, the right to request rectification, erasure or restriction of the processing of personal data of the data subject, and the right to object to such processing;
  - to obtain a copy of the data (Article 15(3) of the GDPR) - to obtain a copy of the data being processed, with the first copy being free of charge, and for subsequent copies the Data Controller may charge a reasonable fee based on administrative costs;
  - to rectify (Article 16 of the GDPR) - to request the rectification of personal data concerning them that is incorrect, or the completion of incomplete data;
  - to erase (Article 17 of the GDPR) - to request erasure of their personal data if the Data Controller no longer has a legal basis for processing or the data are no longer necessary for the purposes of processing;
  - to restrict processing (Article 18 of the GDPR) - to request restriction of processing of personal data when:
    - the data subject disputes the accuracy of the personal data - for a period that allows the Data Controller to verify the accuracy of the data,
    - processing is unlawful, and the data subject objects to the erasure of the data and requests restriction of its use,
    - the Data Controller no longer needs the data, but they are needed by the data subject to establish, assert or defend a claim,
    - the data subject has objected to the processing - until it is determined whether the legitimate grounds on the part of the Controller override the grounds of the data subject’s objection;
  - to data portability (Article 20 GDPR) - to receive in a structured, commonly used, machine-readable format the personal data concerning them that they have provided to the Controller, and to request that the data be sent to another Controller if the data are processed on the basis of the data subject’s consent or a contract with them, and if the data are processed in an automated manner;
  - to object (Article 21 GDPR) - to object to the processing of their personal data for the legitimate purposes of the Controller, on grounds related to their particular situation, including the objection to profiling. Then the Data Controller shall assess the existence of valid legitimate grounds for the processing, overriding the interests, rights and freedoms of the data subjects, or grounds for establishing, asserting or defending claims. If, according to the assessment, the interests of the data subject outweigh the interests of the Controller, the Controller will be obliged to stop processing the data for these purposes;
  - to withdraw consent at any time and without stating a reason; however, the processing of personal data carried out before the withdrawal of consent will continue to be lawful. Withdrawal of consent will result in the Controller ceasing to process personal data for the purpose for which the consent was given.
- In order to exercise the aforementioned rights, the data subject should contact, using the contact details provided, the Data Controller and inform them which right and to what extent they wish to exercise.
President of the Personal Data Protection Office
- The data subject has the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office, based in Warsaw, at ul. Stawki 2, who can be contacted:
- by mail: ul. Stawki 2, 00-193 Warszawa;
- via electronic mailbox available at: https://www.uodo.gov.pl/pl/p/kontakt;
- Hotline: 606-950-0000.
Data Protection Officer
- In any case, the data subject may also directly contact the Data Protection Officer of the Controller by email or in writing to the address of the Controller as provided in Section 1, Item 2 of this Privacy and Cookies Policy.
Changes to the Privacy Policy
- The Privacy and Cookies Policy may be supplemented or updated according to the current needs of the Controller in order to provide current and reliable information to Customers/Users.
Cookies
- The Online Store obtains information about Customers/Users and their behaviour as follows:
  - through voluntarily entered information in forms for purposes arising from the function of a specific form;
  - by storing cookies in the end devices;
  - by collecting web server logs by the Online Store’s hosting operator (necessary for proper operation of the website).
- Cookies are IT data, in particular text files, which are stored on the Customer’s / User’s end device and are intended for the use of the website of the Online Store. Cookies usually contain the name of the website from which they originate, the time for which they are stored on the end device and a unique number.
- The Online Store uses cookies only after the Customer/User of the store has given prior consent in this regard. Agreeing to the Online Store’s use of all cookies is done by clicking the button: “Accept all” when the message about the Online Store’s use of cookies is displayed.
- If the Customer/User of the Online Store does not consent to the Online Store’s use of all cookies, they can use the “Customise” option, which allows to adjust their preferences and refuse to consent to the use of optional cookies. The “Customise” option does not allow to disable the necessary cookies. In order to block the necessary (required) cookies, the Customer/User may make changes in the settings of the web browser they are currently using (however, this may result in incorrect functioning of the website of the Online Store).
- To manage cookie settings in the web browser, select web browser/system from the list and follow the instructions: Internet Explorer, Chrome, Safari, Firefox, Opera, Android, Safari (iOS), Windows Phone.
- The legal basis for the processing of personal data from cookies is the legitimate interests of the Data Controller to provide quality services and ensure the security of services.
- The Online Store uses two main types of cookies: session cookies and persistent cookies. Session cookies are temporary files that are stored on the User’s end device until the User logs out, leaves the Online Store or closes the software (web browser). Persistent cookies are stored on the Customer/User’s end device for the time specified in the parameters of the cookies or until they are deleted by the Customer/User.
- Cookies are used for the following purposes:
  - creating statistics that help to understand how the Customers/Users of the Online Store use the websites, which allows to improve their structure and content;
  - maintaining the Customer/User session (after logging in), thanks to which the Customer/User does not have to re-enter their login and password on each sub-page of the Online Store;
  - determining the Customer/User's profile in order to display product recommendations and tailored materials in advertising networks, in particular the Google network.
- Web browsing software (web browser) usually allows cookies to be stored on the Customer/User’s end device by default. Customers/Users may change their settings in this regard. The web browser allows to delete cookies. It is also possible to automatically block cookies.
- Restrictions on the use of cookies may affect some of the functionality available on the websites of the Online Store.
- Cookies are placed on the Customer’s/User’s end device and may also be used by advertisers cooperating with the Online Store and partners of the Online Store.
- Cookies may be used by the Google network, to display advertisements tailored to the way the Customer/User uses the Online Store. For this purpose, they can keep information about the User’s navigation path or the time they stayed on a particular page: https://policies.google.com/technologies/partner-sites.
- We recommend that the Customer/User read the privacy policies of these companies to understand the use of cookies used in statistics: Google Analytics Privacy Policy.
- With regard to the information about the Customer’s/User’s preferences collected by the Google advertising network, the Customer/User can view and edit the information resulting from cookies using the tool: https://www.google.com/ads/preferences/.
- The Online Store website has plug-ins that may transmit data from Customers/Users’ cookies to Controllers such as: Google Maps, Google Analytics, Meta (Facebook), Google Ads, PayPal, Google reCAPTCHA, IdoAccounts, IdoSell, IAI S.A., Google.
Newsletter
- The Customer may agree to receive commercial information by e-mail, by selecting the appropriate option in the registration form or at a later date in the appropriate tab. If such consent is given, the Customer/User will receive information (Newsletter) from the Online Store, as well as other commercial information sent by the Seller to the email address provided by the Customer/User.
- The Customer may unsubscribe from the Newsletter at any time by themselves, by unchecking the appropriate box on their Account page, by going to the form https://toya24.pl/newsletter.php, by clicking on the appropriate link located in the content of each Newsletter, or through Customer Service.
Account
- The Customer/User may not upload or provide illegal content, including opinions and other data, to the Online Store or to the Seller.
- The Customer/User gains access to the Account after registration.
- As part of the registration, the Customer / User provides the type of account or gender, first name, last name, company name, NIP [tax identification number], sales document details, shipping details, email address, and selects a password. The Customer/User assures that the data provided by them in the registration form are true. Registration requires thorough reading of the Regulations and indicating on the registration form that the Customer/User has read the Regulations and fully accepts all their provisions.
- At the moment of granting the Customer/User access to the Account a contract for the provision of electronic services concerning the Account is concluded between the Seller and the Customer for an indefinite period of time. The consumer may withdraw from this contract under the terms of the Regulations.
- Registration of an Account on one of the pages of the Online Store means at the same time registration allowing access to the other pages under which the Online Store is available.
- The Customer/User may terminate the contract for the provision of electronic services at any time with immediate effect by notifying the Seller by e-mail or in writing to the Data Controller’s address as specified in Section 1 Item 2 of this Privacy and Cookies Policy.
- The Seller has the right to terminate the service contract for the Account in case of discontinuation of the provision or transfer of the Online Store service to a third party, violation of the law or the provisions of the Regulations by the Customer/User, as well as in case of inactivity of the Customer/User for a period of 6 months. Termination of the contract is subject to a seven-day notice period. The Seller may stipulate that re-registration of the Account will require the permission of the Seller.

Privacy and Cookies Policy

Privacy and cookies policy

Necessary (required) cookies

Analytical cookies

Advertising cookies