PRIVACY POLICY
1. GENERAL PROVISIONS
1.1. This Privacy Policy sets out the rules for the processing of personal data and the use of cookies in the PALCHE online store, available at https://palche.eu.
1.2. The controller of personal data is:
PALCHE AGRO Sp. z o.o.
ul. Północna 3, 24-220 Niedrzwica Duża, Poland
NIP: 7133140790
REGON: 542807355
KRS: 0001196276
E-mail: info@palcheagro.pl
Tel.: +48 574 610 904
1.3. Personal data are processed in accordance with:
• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (RODO / GDPR).
• The Act of the Republic of Poland of 10 May 2018 on the Protection of Personal Data.
2. PERSONAL DATA
2.1. Categories of personal data
We may process the following personal data:
• First name and surname / company name
• Delivery and billing address
• E-mail address and telephone number
• Order, payment and delivery data
• IP address and technical browser data
• Cookies
• Other data voluntarily provided by the user
2.2. Purposes of data processing
• Placing and fulfilment of orders
• Conclusion and performance of the contract of sale
• Delivery of goods and settlements
• Accounting and tax records
• Communication with the customer
• Marketing (only on the basis of a separately given consent)
2.3. Obligation to provide data and consequences of refusal
The provision of personal data is voluntary but necessary for the placement and fulfilment of an order (name, address, e-mail, telephone number), and constitutes a condition for the conclusion of a contract of sale. Without these data, the fulfilment of the order is not possible.
The provision of data for marketing purposes is entirely voluntary. Refusal to provide such data does not affect the ability to place an order.
2.4. Data retention periods
Personal data are stored only for as long as necessary to fulfil the purposes of processing. Data processed for marketing purposes are stored until the user withdraws consent.
2.5. Where data of third parties are provided, the user confirms that he/she has a lawful basis for providing them.
3. LEGAL BASES FOR PROCESSING UNDER RODO / GDPR
The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (RODO / GDPR) on the following legal bases:
• Processing is necessary for the performance of a contract of sale or to take steps at the request of the user prior to entering into a contract (Art. 6(1)(b) GDPR).
• For compliance with a legal obligation to which the controller is subject, in particular in the field of accounting and tax records (Art. 6(1)(c) GDPR).
• For the purposes of the legitimate interests pursued by the controller — ensuring the security of the service, protection against fraud, establishing or defending potential claims, and improving the functioning of the service (Art. 6(1)(f) GDPR).
• On the basis of the user's voluntary consent for marketing purposes, the sending of informational materials, and the use of non-essential cookies (Art. 6(1)(a) GDPR). Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to its withdrawal.
4. TRANSFER OF PERSONAL DATA
4.1. Data may be transferred to the following categories of recipients:
• Courier services (delivery of goods)
• Payment operators
• Accounting and tax services
• IT and hosting providers
4.2. Data are not sold or transferred to third parties for their own marketing purposes.
5. PROTECTION OF PERSONAL DATA
5.1. Technical and organisational measures are applied to protect data against unauthorised access, alteration or disclosure.
5.2. Access to data is limited to authorised persons responsible for the fulfilment of orders and customer service.
6. USERS' RIGHTS
In accordance with RODO / GDPR, the user has the following rights:
• Right of access to find out what personal data concerning him/her are being processed and to receive a copy thereof (Art. 15 GDPR).
• Right to rectification to request the updating or correction of inaccurate or incomplete data (Art. 16 GDPR).
• Right to erasure ("right to be forgotten") (Art. 17 GDPR).
• Right to restriction of processing to request the temporary suspension of the processing of personal data in certain situations (Art. 18 GDPR).
• Right to data portability to receive personal data in a structured, commonly used format and to transfer them to another controller (Art. 20 GDPR).
• Right to object to object to the processing of personal data carried out on the basis of the legitimate interests of the controller, in particular for direct marketing and profiling (Art. 21 GDPR). In the case of direct marketing, the objection is unconditional — the controller is obliged to cease such processing.
• Right to withdraw consent to withdraw the consent given at any time, without affecting the lawfulness of processing carried out prior to its withdrawal (Art. 7(3) GDPR).
• Right to lodge a complaint with a supervisory authority to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, www.uodo.gov.pl, if you consider that the processing of your personal data infringes the requirements of the GDPR (Art. 77 GDPR).
To exercise any of the above rights, please send a written request to: info@palcheagro.pl
7. AUTOMATED DECISION-MAKING AND PROFILING
7.1. Fact and nature of profiling
The controller carries out profiling of users within the meaning of Art. 4(4) GDPR. Profiling is applied exclusively for the purposes set out in section 7.2. No fully automated decisions producing legal effects or similarly significantly affecting the user within the meaning of Art. 22(1) GDPR are taken without the involvement of an authorised employee.
7.2. Data used for profiling
The following categories of personal data are used for profiling:
• Purchase history (ordered goods, frequency and value of orders)
• Activity on the website (pages visited, time spent, interactions with the product catalogue)
• Contact and registration data provided through forms
• Cookies and session identifiers
• Technical data about the device and browser (device type, operating system, language)
• Approximate location of the user (based on IP address)
7.3. Purposes of profiling
• Personalisation of content and product offers on the website
• Formulation of discount and bonus offers (subject to subsequent human verification)
• Marketing analytics and user segmentation
• Risk assessment, namely detection of suspicious or fraudulent activity
7.4. Possible impact of profiling on the user
On the basis of profiling results, an authorised employee may take a decision regarding:
• Granting or adjusting a discount or special terms
• Personalised recommendation of products or categories
• Restricting access to certain promotions or bonuses
• Temporary suspension or blocking of an account in the event of confirmed suspicious activity
7.5. Legal bases for profiling
• Personalisation of content and marketing: voluntary consent of the user (Art. 6(1)(a) GDPR).
• Risk assessment and protection against fraud: legitimate interest of the controller (Art. 6(1)(f) GDPR).
7.6. Right to object and withdrawal of consent
The user is entitled at any time to object to profiling (Art. 21 GDPR) or to withdraw consent. This right may be exercised in the following ways:
• Through the cookie consent banner upon entering the website — by declining analytical and marketing cookies
• Through browser settings — by blocking or deleting cookies
• By sending a written request to: info@palcheagro.pl
Restricting cookies may result in a partial loss of personalisation but does not prevent the placement of an order. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.
8. COOKIES
A cookie is a text file or files containing a small amount of information, which are sent to the web browser and stored on the user's device.
8.1. The website uses cookies for the following purposes:
• Ensuring the operation of the store
• Visit analytics
• Improving the functionality of the website
• Marketing purposes (subject to user consent)
8.2. Cookies associated with the account of an authenticated user may allow his/her identification. Anonymous (technical) cookies do not allow the direct identification of the user.
9. MANAGING COOKIES
9.1. The user may:
• Change cookie settings in the browser
• Delete cookies
• Block cookies in whole or in part
9.2. Restricting cookies may affect the functionality of the website.
10. TRANSFER OF DATA OUTSIDE THE EU
10.1. Where third-party services are used, including Google, Meta and other providers of analytics, marketing or cloud services, personal data may be transferred to countries outside the European Economic Area (EEA).
10.2. Such transfer is carried out with an adequate level of data protection ensured, on the basis of one of the following mechanisms:
• Adequacy decision of the European Commission — where the recipient country has been recognised by the Commission as ensuring an adequate level of data protection.
• Standard Contractual Clauses (SCC) approved by the European Commission (Art. 46(2)(c) GDPR).
• Other mechanisms provided for under Art. 46 or Art. 49 GDPR.
10.3. The user is entitled to obtain a copy of the safeguards applied or information about where they have been made available, by sending a request to: info@palcheagro.pl
11. CHANGES TO THE POLICY
11.1. The controller is entitled to amend this Privacy Policy in connection with changes in legislation, decisions of supervisory authorities, or changes in the operation of the service.
11.2. The controller shall notify users of any changes to the Policy by publishing the updated version on the website with the date of entry into force indicated, and, in the case of material changes, by sending a notification to the e-mail addresses of registered users.
11.3. Where changes relate to processing on the basis of consent (Art. 6(1)(a) GDPR), the controller shall request new, separate consent from the user prior to the commencement of such processing. Continued use of the website shall not be deemed equivalent to giving consent to the new personal data processing