Privacy policy (GDPR)

Effective from:

Introduction

This Privacy Policy (GDPR) is MUZEL Shop’s primary, detailed notice on personal-data processing required by the GDPR. MUZEL Shop’s Privacy Summary is provided as a practical overview and does not replace this Policy. This Policy explains the processing of data in connection with use of www.muzel.pl, account creation, placing Orders, contacting MUZEL and receiving transactional communications related to Orders.
The controller of personal data is MUZEL Sp. z o.o., ul. Skandynawska 5, Modła Królewska, 62-571 Stare Miasto, Poland, KRS 0000573546, NIP/VAT PL 6652999493, REGON 362405877.
For personal-data protection matters, contact: a.severyn@muzel.eu. For Orders, payments, delivery, returns and complaints: shop@muzel.pl.
This Policy applies to visitors of the Site, account holders, persons placing Orders or contacting MUZEL, persons receiving transactional communications related to Orders and contact persons or representatives of Buyers acting as Entrepreneurs.

The Terms & Conditions of Sale, Shipping & Delivery Policy and Refund & Return Policy respectively govern formation and performance of the sales Contract, including Price, VAT, payment, delivery, returns and complaints. Use of the Site is governed by the Terms of Website Use. Those documents do not change the data-processing rules described in this Policy.
Detailed rules on cookies and similar technologies are set out in the separate Cookie Policy.

Personal data we may collect

Depending on how the Site or Store is used, we may process the following categories of personal data:
• identity and contact data: name, company name, role, email address, telephone number, billing address and delivery address;
• account and Order data: login details, Order history, selected Goods, quantities, correspondence and documents connected with an Order;
• payment data: the chosen payment method, payment status and transaction identifiers supplied by payment providers; MUZEL does not store full payment-card numbers;
• delivery, return and complaint data: recipient details, shipment information, batch numbers, photographs of damage and the content of reports;
• technical data: IP address, device and browser identifiers, security logs, information about use of the Site and cookies;
transactional-communication data: the Order Acknowledgement, information about payment, dispatch, invoice, return, withdrawal, complaint and Order-related correspondence.
We mainly obtain data directly from the person concerned. In business relations, contact data may also be obtained from the organisation that the person represents or from publicly available professional sources. Please do not send us special categories of personal data unless necessary for a particular matter.

Use of personal data: purposes and lawful bases

We use personal data only to the extent necessary for the stated purposes:
creating and operating an account, accepting an Order, entering into and performing a Contract, handling payment, delivery, returns, complaints and Order-related contact, including sending the Order Acknowledgement and other transactional communications concerning payment, dispatch, invoice, return, withdrawal or complaint – Article 6(1)(b) GDPR; for persons representing an Entrepreneur – Article 6(1)(f) GDPR;
• issuing invoices, tax and accounting settlements and compliance with other legal obligations – Article 6(1)(c) GDPR;
• business contact, handling correspondence, complaints and requests, protecting the Site and accounts, preventing fraud, pursuing or defending claims and debt recovery – Article 6(1)(f) GDPR;
cookies and similar technologies other than necessary cookies – only where they are actually used and after prior consent where consent is required – Article 6(1)(a) GDPR;
• functional, analytics and marketing cookies – according to the user’s choice where consent is required.
Providing data marked as required is necessary to create an account, place or fulfil an Order or handle a matter. Failure to provide these data may make the relevant action impossible. Data relating to cookies other than necessary cookies are voluntary where such technologies are actually used and require consent. MUZEL does not use data to market third-party products or services unless separate information is provided and any consent required by law is obtained beforehand.

Disclosure of personal data

Data may be disclosed only to the extent necessary to providers supporting MUZEL, including:
• providers of hosting, Site maintenance, WordPress/WooCommerce and plugins actually used;
payment providers, including Stripe and PayPal, banks and entities supporting payment processing – only where required by the payment method selected;
• carriers and logistics partners carrying out delivery or returns;
providers of accounting, invoicing, email used for transactional communications, IT and security services – where used;
• legal advisers, insurers and public authorities where required by law.
MUZEL does not sell personal data. Data may also be disclosed where required by law or necessary to establish, pursue or defend claims.

International transfers of personal data

Some MUZEL service providers may process data outside the European Economic Area. Where this occurs, MUZEL uses an appropriate transfer mechanism, in particular an adequacy decision or standard contractual clauses together with any required supplementary measures.
Information about the safeguards used may be obtained by contacting MUZEL at a.severyn@muzel.eu.

Retention of personal data

We retain data no longer than necessary for the purpose for which they were collected, taking account of legal obligations and limitation periods for claims.
• Order documents, invoices and tax settlements – for the period required by tax and accounting law, generally 5 years from the end of the calendar year in which the tax obligation arose;
• account and business-relation data – while the account or relationship is active and then for the time needed to handle claims and meet legal obligations;
• complaint, return, correspondence and dispute data – while the matter is handled and then for the period necessary to establish, pursue or defend claims, generally up to 6 years;
data relating to transactional communications connected with an Order – for the retention period applicable to the relevant Order, accounting records or claims;
• security logs and technical data – normally up to 12 months, unless longer retention is necessary for security, detecting abuse or proceedings;
cookies – for the periods specified in the Cookie Policy.
We do not apply unlimited retention periods or indefinite consent.

Protection of personal data

MUZEL applies technical and organisational measures appropriate to the risk, including restricted access to data, access controls, transmission encryption, data minimisation, backups and supplier assessment.
No IT system can guarantee complete security; however, MUZEL responds to incidents in accordance with applicable law.

Children

The Site and Store are not directed at children. MUZEL does not intend knowingly to collect children’s personal data in connection with use of the Site or Store.
If MUZEL receives a reasonable indication that a child’s data are being processed without the legal basis required, it will take appropriate steps in accordance with applicable law.

Changes and amendments

MUZEL may update this Policy, in particular where law, Store processes, providers or technology change. The current version will be published on the Site with an effective date.
If a change materially affects a processing purpose, lawful basis or scope of consent, MUZEL will take the steps required by law, including, where necessary, providing additional information or obtaining new consent.

Your rights

A data subject has, to the extent provided by law, the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, including direct marketing, and withdrawal of consent at any time.
A request may be sent to a.severyn@muzel.eu. MUZEL responds without undue delay, normally within one month of receiving the request. Where necessary, MUZEL may request information allowing it to verify the identity of the person making the request.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO).

Automated decisions and third-party websites

MUZEL does not make decisions concerning individuals based solely on automated processing which produce legal effects or similarly significantly affect them. Payment providers may apply their own security, verification or fraud-prevention mechanisms under their privacy policies.
The Site may contain links to third-party websites. MUZEL is not responsible for their content or privacy practices. However, where third-party services are used within the Store, their processing of data is described in this Policy and, for cookies, in the Cookie Policy.

Information updating

Please inform MUZEL if data need to be updated or corrected. This does not limit the right to request rectification as described above.

Cookies

MUZEL uses cookies and similar technologies. Cookies necessary for operation of the Site and the Order process may be used without consent where permitted by law.
Cookies other than necessary cookies are used only where they are actually implemented and, where consent is required, after consent is obtained. The cookie banner allows the User to reject them by selecting “Reject non-essential”.