Privacy summary

Effective from:

Introduction

This Privacy Summary is a short overview of MUZEL Shop’s personal-data processing in connection with use of www.muzel.pl, account creation, placing Orders, contacting MUZEL and receiving transactional communications related to Orders. It does not replace the detailed Privacy Policy (GDPR), which is the primary information notice required by the GDPR.
The controller of personal data is MUZEL Sp. z o.o., ul. Skandynawska 5, Modła Królewska, 62-571 Stare Miasto, Poland, KRS 0000573546, NIP/VAT PL 6652999493, REGON 362405877.
For personal-data protection matters, contact: a.severyn@muzel.eu. For Orders, payments, delivery, returns and complaints: shop@muzel.pl.
This Summary applies to visitors of the Site, account holders, persons placing Orders or contacting MUZEL, persons receiving transactional communications related to Orders and contact persons or representatives of Buyers acting as Entrepreneurs.
Detailed rules on cookies and similar technologies are set out in the separate Cookie Policy. The detailed Privacy Policy (GDPR) contains the information required by GDPR, including lawful bases, retention periods, data-subject rights, sources of data and data transfers.

Personal data we may collect

Depending on how the Site or Store is used, we may process the following categories of personal data:
• identity and contact data: name, company name, role, email address, telephone number, billing address and delivery address;
• account and Order data: login details, Order history, selected Goods, quantities, correspondence and documents connected with an Order;
• payment data: the chosen payment method, payment status and transaction identifiers supplied by payment providers; MUZEL does not store full payment-card numbers;
• delivery, return and complaint data: recipient details, shipment information, batch numbers, photographs of damage and the content of reports;
• transactional-communication data: the Order Acknowledgement, information about payment, dispatch, invoice, return, withdrawal, complaint and Order-related correspondence.
We mainly obtain data directly from the person concerned. In business relations, contact data may also be obtained from the organisation that the person represents or from publicly available professional sources. Please do not send us special categories of personal data unless necessary for a particular matter.

Use of personal data: purposes and lawful bases

We use personal data only to the extent necessary for the stated purposes:
• creating and operating an account, accepting an Order, entering into and performing a Contract, handling payment, delivery, returns, complaints and Order-related contact, including sending an Order Acknowledgement and other transactional communications about payment, dispatch, invoice, return, withdrawal or complaint – Article 6(1)(b) GDPR; for persons representing an Entrepreneur – Article 6(1)(f) GDPR;
• issuing invoices, tax and accounting settlements and compliance with other legal obligations – Article 6(1)(c) GDPR;
• business contact, handling correspondence, complaints and requests, protecting the Site and accounts, preventing fraud, pursuing or defending claims and debt recovery – Article 6(1)(f) GDPR;
• cookies other than necessary cookies – only where they are actually used and, where required by law, after obtaining the required consent.
Providing data marked as required is necessary to create an account, place or fulfil an Order or handle a matter. Failure to provide these data may make the relevant action impossible. Transactional-communication data are necessary to handle an Order. MUZEL does not operate a separate marketing newsletter or use a CRM in the Store-handling process; emails related to an Order are transactional, not marketing communications.

Disclosure of personal data

Data may be disclosed only to the extent necessary to providers supporting MUZEL, including:
• providers of hosting, Site maintenance, WordPress/WooCommerce and plugins actually used;
• payment providers, including Stripe and PayPal, banks and entities supporting payment processing;
• providers of accounting, invoicing, email, IT and security services – where used;
• legal advisers, insurers and public authorities where required by law.
MUZEL does not sell personal data. Data may also be disclosed where required by law or necessary to establish, pursue or defend claims.

International transfers of personal data

Some MUZEL service providers may process data outside the European Economic Area. Where this occurs, MUZEL uses an appropriate transfer mechanism, in particular an adequacy decision or standard contractual clauses together with any required supplementary measures.
Information about the safeguards used may be obtained by contacting MUZEL at a.severyn@muzel.eu.

Retention of personal data

We retain data no longer than necessary for the purpose for which they were collected, taking account of legal obligations and limitation periods for claims.
• Order documents, invoices and tax settlements – for the period required by tax and accounting law, generally 5 years from the end of the calendar year in which the tax obligation arose;
• account and business-relation data – while the account or relationship is active and then for the time needed to handle claims and meet legal obligations;
• complaint, return, correspondence and dispute data – while the matter is handled and then for the period necessary to establish, pursue or defend claims, generally up to 6 years;
• transactional-communication data related to an Order – for the retention period applicable to the relevant Order, accounting records or claims;
• security logs and technical data – normally up to 12 months, unless longer retention is necessary for security, detecting abuse or proceedings;
• cookies – for the period specified in the Cookie Policy, no longer than necessary for the purpose of the relevant technology.
We do not apply unlimited retention periods or indefinite consent.

Protection of personal data

MUZEL applies technical and organisational measures appropriate to the risk, including restricted access to data, access controls, transmission encryption, data minimisation, backups and supplier assessment.
No IT system can guarantee complete security; however, MUZEL responds to incidents in accordance with applicable law.

Changes and amendments

MUZEL may update this Policy, in particular where law, Store processes, providers or technology change. The current version will be published on the Site with an effective date.
If a change materially affects a processing purpose, lawful basis or scope of consent, MUZEL will take the steps required by law, including, where necessary, providing additional information or obtaining new consent.

Your rights

A data subject has, to the extent provided by law, the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, including direct marketing, and withdrawal of consent at any time.
A request may be sent to a.severyn@muzel.eu. MUZEL responds without undue delay, normally within one month of receiving the request. Where necessary, MUZEL may request information allowing it to verify the identity of the person making the request.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO).

Third-party websites

The Site may contain links to third-party websites. MUZEL is not responsible for their content or privacy practices. However, where third-party services are used within the Store, their processing of data is described in this Policy and, for cookies, in the Cookie Policy.

Information updating

Please inform MUZEL if data need to be updated or corrected. This does not limit the right to request rectification as described above.

Cookies

MUZEL uses cookies and similar technologies. Cookies necessary for operation of the Site and the Order process may be used without consent where permitted by law.
Cookies other than necessary cookies are used only where they are actually implemented and, where consent is required, after consent is obtained. The cookie banner enables the User to reject them by selecting “Reject non-essential”.
The separate Cookie Policy sets out detailed rules on cookies, including their categories, purposes and periods of operation. MUZEL does not use a separate CMP.