Login

Language

Cart

Your cart is empty

Owca Newsletter

Wool news and a little bit of good — straight to your inbox!

Privacy policy

§1 – General provisions

  1. This document sets out the Privacy Policy of the Owca online shop – https://owcasklep.pl – operated by Futro i Szkło s.c. with its registered office in Wrocław, ul. Ostrowskiego 7/516, 53-238 Wrocław, Poland, NIP (tax ID): 8992785237, REGON: 363849978, tel. 889 390 252, e-mail: halo@owcasklep.pl, and covers in particular the rules on the protection of personal data and the security of other data entered into the Service by the User.
  2. The Privacy Policy is an integral annex to the Terms and Conditions of the online shop https://owcasklep.pl.

§2 – Definitions

The terms used in this document mean:

  1. Personal data controller (also referred to as the Controller) – Futro i Szkło s.c. with its registered office in Wrocław, ul. Ostrowskiego 7/516, 53-238 Wrocław, Poland, NIP: 8992785237, REGON: 363849978, tel. 889 390 252, e-mail: halo@owcasklep.pl.
  2. Service – the website at https://owcasklep.pl and all its subpages.
  3. User – a natural person who uses the Service and provides their personal data through it,
  4. Personal data – information about an identified or identifiable natural person, identifiable by one or more specific factors relating to their physical, physiological, genetic, mental, economic, cultural or social identity, including image, voice recording, contact details, location data, information contained in correspondence, and information collected via recording equipment or other similar technology,
  5. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC,
  6. Terms and Conditions – the Terms and Conditions of the online shop https://owcasklep.pl.

§3 – Protection of personal data

  1. The Controller is the controller of personal data within the meaning of the GDPR.
  2. The Controller collects and processes personal data in accordance with the applicable law, in particular the GDPR, and in accordance with the principles laid down therein.
  3. The Controller provides information about the processing of data at the time it is collected. The Controller processes data to the extent, for the time and for the purposes indicated in each case in the information provided under the forms used to collect personal data from the User.
  4. The Controller transfers Personal data only to the Controller's trusted subcontractors, i.e. couriers, providers responsible for operating IT systems, entities such as warehouses, banks and payment operators, entities providing accounting and legal services, marketing agencies (with regard to marketing services), and entities providing other IT and software services.
  5. The Controller has the right to disclose selected Personal data of the User to competent authorities and third parties if this is required by applicable law and if those entities request it on an appropriate legal basis.
  6. The Controller ensures the security and confidentiality of the personal data processed and enables the User to access information about the processing of their data. If, despite the security measures applied, a personal data breach occurs (e.g. a data “leak” or loss) and such a breach could result in a high risk to the User's rights or freedoms, the Controller will inform the User of such an event in accordance with the law.
  7. The User may contact the data controller. The contact details are as follows:
    Postal address: ul. Ostrowskiego 7/516, 53-238 Wrocław, Poland
    E-mail address: halo@owcasklep.pl

§4 – Security of personal data

  1. The Controller uses all technical and organisational means available to it to ensure the security of the User's personal data and to protect it against accidental or deliberate destruction, accidental loss, modification, unauthorised disclosure or access. Users' personal data is stored and processed on highly secure servers, with appropriate security measures in place that meet the requirements of Polish law.
  2. Entrusted data is stored on top-class equipment and servers in appropriately secured data centres to which only authorised persons have access.
  3. The Controller carries out personal data processing activities in compliance with all legal and technical requirements imposed on it by data protection law. The Controller continuously analyses the risks associated with its processing of personal data and ensures that only authorised persons have access to the data, and only to the extent necessary for the performance of their duties.
  4. The Controller takes all necessary steps to ensure that its subcontractors and other cooperating entities also guarantee the application of appropriate security measures whenever they process Personal data on behalf of the Controller.
  5. The Controller undertakes to keep backup copies containing the User's personal data.

§5 – User rights

  1. If their personal data changes, the User should update it by sending an appropriate message to the Controller.
  2. The User has the following rights:
    1. the right to information about the processing of Personal data,
    2. the right to obtain a copy of the Personal data processed by the Controller,
    3. the right to rectification of Personal data,
    4. the right to erasure of Personal data (on this basis, the User may request the erasure of data whose processing is no longer necessary for any of the purposes for which it was collected),
    5. the right to restriction of processing of Personal data,
    6. the right to data portability,
    7. the right to object to the processing of Personal data for marketing purposes (the User may object at any time to the processing of Personal data for marketing purposes, without having to justify such an objection),
    8. the right to object to other purposes of data processing (the User may at any time object – on grounds relating to their particular situation – to the processing of Personal data carried out on the basis of the Controller's legitimate interest; such an objection must be justified),
    9. the right to withdraw consent, where Personal data is processed on the basis of consent (withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal),
    10. the right to lodge a complaint with the supervisory authority competent for the User's habitual residence, place of work or place of the alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO).
  3. The Controller may refuse to erase the User's personal data if retaining it is necessary due to an obligation imposed on the Controller by law.
  4. The User has the right to submit a request to exercise the rights indicated above by post or electronically (e-mail). The Controller's contact details are given in § 3 section 7.
  5. If, on the basis of the request referred to in section 4, the Controller is unable to determine and identify the natural person to whom the request relates, it will ask the applicant for additional information. Failure to provide additional information will result in refusal to comply with the applicant's request.
  6. The Controller responds to a request within one month of its receipt. If this deadline needs to be extended, the Controller informs the applicant of the reasons and the expected date of the response.

§6 – Legal basis, purpose and period of storage of personal data

  1. Personal data is processed for the following purposes and on the following legal bases:
    1. Use of the Service:
      The personal data of all persons using the Service (including IP address or other identifiers and information collected via cookies or other similar technologies) is processed by the Controller for the purpose of:
      1. providing services electronically (legal basis: processing necessary for the performance of a contract – Article 6(1)(b) GDPR),
      2. analytical and statistical purposes (legal basis: consent – Article 6(1)(a) GDPR),
      3. establishing and pursuing claims or defending against claims (legal basis: the Controller's legitimate interest – Article 6(1)(f) GDPR, namely the protection of the Controller's rights).
    2. Order form:
      In order to place an order in the Service, the User is asked to provide the Personal data indicated in the order form. Providing the data is not mandatory, but refusal to provide it makes it impossible to place an order. The Personal data provided by the User is processed by the Controller for the purpose of:
      1. providing services electronically and concluding the sales contract (legal basis: processing necessary for the performance of a contract – Article 6(1)(b) GDPR),
      2. analytical and statistical purposes (legal basis: consent – Article 6(1)(a) GDPR),
      3. establishing and pursuing claims or defending against claims (legal basis: the Controller's legitimate interest – Article 6(1)(f) GDPR, namely the protection of the Controller's rights),
      4. obtaining reviews of the purchased product and the concluded contract (legal basis: the Controller's legitimate interest – Article 6(1)(f) GDPR, namely the ability to obtain reviews of the products sold).
    3. Marketing
      The Controller processes Users' Personal data in order to carry out marketing activities, which may consist in particular of sending commercial information electronically for the purposes of direct marketing of goods and services. In such a case, the User's Personal data is processed by the Controller on the basis of Article 6(1)(f) GDPR. The Controller's marketing purposes may be pursued through profiling, consisting of the automated processing of Personal data and its evaluation in order to analyse the user's behaviour and make predictions, which makes it possible to display content to the User that matches their individual preferences and interests. In this respect, the User's Personal data is processed by the Controller on the basis of the User's consent (Article 6(1)(a) GDPR), which may be withdrawn.
    4. Traditional and electronic correspondence (e-mail)
      The User may send messages to the Controller by e-mail using the Controller's contact details available in the Service, the Terms and Conditions or this Privacy Policy. The Controller uses the Personal data contained in such correspondence solely for the purpose of communication and handling the matter to which the correspondence relates. The legal basis for processing the Data is the Controller's legitimate interest – Article 6(1)(f) GDPR – consisting of maintaining correspondence addressed to it in connection with its business activity, and, in the case of contact relating to the services provided or a contract, processing necessary for the performance of a contract – Article 6(1)(b) GDPR.
    5. Telephone contact
      The User may contact the Controller by telephone for purposes related to the services provided or a concluded contract, as well as in other matters. If telephone contact is made in matters unrelated to a concluded contract or a service provided, the Controller may request Personal data only where this is necessary to handle the matter raised. The legal basis for processing Personal data is the Controller's legitimate interest – Article 6(1)(f) GDPR – consisting of the need to resolve the matter raised in connection with its business activity, and, in the case of contact relating to the services provided or a contract, processing necessary for the performance of a contract – Article 6(1)(b) GDPR.
    6. Social media profiles
      The Controller has profiles on social media (including Instagram and Facebook). The Controller processes Personal data left by persons visiting the profiles, e.g. comments or online identifiers. The Controller uses this data to run the profiles effectively, to enable activity on these profiles, and for analytical and statistical purposes. The legal basis for processing Personal data is the Controller's legitimate interest – Article 6(1)(f) GDPR – consisting of promoting its business and services and, where applicable, pursuing claims or defending against claims of third parties. The above does not apply to the processing of personal data by social media platforms. For information on how social media platforms process data, please refer to their personal data processing policies.
    7. Back-in-stock notification
      The Controller processes Personal data in the form of the User's e-mail address or telephone number, together with information about the product to which the request relates, in order to send a notification that the product is back in stock. Providing the data is voluntary but necessary to receive the notification. The legal basis for processing Personal data is processing necessary for the performance of a contract – Article 6(1)(b) GDPR – consisting of providing the service of notifying the User that the selected product is back in stock. The Controller processes the Personal data until the notification is sent, the request is cancelled by the User, or the waiting period for the product to become available again, as set by the Controller, expires, whichever occurs first.
  2. The period for which the Controller stores Personal data depends on the purpose for which the data is processed, the nature of the service provided and the legal basis for processing. The Controller stores Personal data for the period necessary to achieve the given purpose, taking into account the legal obligations incumbent on the Controller and the limitation periods for claims.
    1. Where Personal data is processed for the purpose of providing services electronically and concluding and performing a sales contract, the data is stored for the period necessary to provide the service, fulfil the order and perform the contract, and thereafter for the period necessary to fulfil the legal obligations incumbent on the Controller and to establish, pursue or defend against any claims.
    2. Where Personal data is processed in order to fulfil legal obligations incumbent on the Controller, in particular tax and accounting obligations, the data is stored for the period required by the applicable law.
    3. Where Personal data is processed on the basis of the User's consent, the data is stored until consent is effectively withdrawn or the purpose for which it was collected ceases, whichever occurs first, unless further storage is necessary to establish, pursue or defend against claims.
    4. Where Personal data is processed on the basis of the Controller's legitimate interest, the data is stored for the period necessary to pursue that interest or until an objection to processing is effectively raised, unless the Controller demonstrates compelling legitimate grounds for further processing which override the interests, rights and freedoms of the data subject, or grounds for establishing, pursuing or defending claims.
    5. Where Personal data is processed in order to send a back-in-stock notification, the data is stored until the notification is sent, the request is cancelled by the User, or the waiting period for the product to become available again, as set by the Controller, expires, whichever occurs first.
    6. After the relevant storage periods have expired, Personal data is erased or anonymised, unless its further storage is required by law or necessary for other lawful processing purposes.
  3. The period of processing of Personal data referred to in section 2 may be extended where processing is necessary to establish, pursue or defend possible claims. After that time, Personal data may be processed only where and to the extent required by applicable law.
  4. After the processing period has expired, Personal data is erased or irreversibly anonymised.

§7 – Cookie policy

  1. The Controller uses cookies. Cookies are small text files sent (saved) by the Service to the User's end device (e.g. computer, smartphone).
  2. The Controller uses cookies to provide services electronically, to improve them and their quality, for analytical and statistical purposes, and to adapt the Service to the needs of its Users. By using cookies, the Controller personalises content and advertisements. The Controller shares information about how the User uses the Service with trusted social media, advertising and analytics partners in order to provide the highest quality services in terms of the operation of the online shop, analytics, matching and personalisation.
  3. The Service uses two types of cookies: “session” cookies and “persistent” cookies. Session cookies are temporary files stored on the User's end device until they log out, leave the website or close the software (web browser). Persistent cookies are stored on the User's end device for the time specified in the cookie parameters or until they are deleted by the User.
  4. The Controller uses the following types of cookies in the Service:
    1. necessary – enable the use of the services and functions available in the Service, e.g. they are used to handle user authorisation or to fill the shopping cart during online shopping;
    2. functional – make it possible to remember the User's choices and to adapt the Service, e.g. with regard to language preferences, font size, the appearance of the Service, etc.;
    3. analytical – make it possible to obtain a range of information, including the number of visits and traffic sources in the Service. This data is collected to determine which pages are visited most often and to compile statistics on traffic in the Service. The Controller uses this data to improve the performance of the Service. The collected data is processed in pseudonymised form. Google Analytics cookies are among this type of cookies;
    4. marketing – make it possible to tailor the content displayed in and outside the Service, including advertisements, to Users' interests. Data on browsing history, activity on websites (e.g. purchase history, how services are used, type of content and advertisements displayed) or geolocation data may be used to present personalised content. A profile of the User's interests is built on the basis of information from the Service and the User's activity on other websites.
  5. Functional, analytical and marketing cookies may be installed by the Controller and its trusted partners via the Service.
  6. The legal basis for processing data in connection with the use of necessary cookies is that the processing of Personal data is necessary for the performance of a contract (Article 6(1)(b) GDPR). For other cookies, the legal basis for processing Personal data is the Controller's legitimate interest or the User's consent (Article 6(1)(a) and (f) GDPR). The Controller must obtain the User's consent in order to use functional, analytical and advertising cookies.
  7. The consent referred to in section 6 is given via an appropriate form displayed during the first visit to the Service. Consent given may be withdrawn or adjusted at any time.
  8. The User may change cookie settings in their web browser.
  9. Changing the settings for cookies and similar technologies may affect the way the Service and the services it provides function.
  10. The Service uses tools from trusted third parties to collect cookies. These entities process cookies in accordance with their privacy policies and other documents setting out standards for cookies. The Controller's trusted third parties include the entities indicated at any given time in the Cookie Declaration available at https://owcasklep.pl/pages/deklaracja-plikow-cookies.

§8 – Logs

  1. In line with the practice of most websites, the Controller stores HTTP requests sent to its server (server logs). Accordingly, the Controller stores the following information:
    1. the IP addresses from which users browse the information content of our service;
    2. the time the request was received,
    3. the time the response was sent,
    4. the name of the client station – identification performed by the HTTP protocol,
    5. information about errors that occurred during the HTTP transaction,
    6. the URL of the page previously visited by the user (referer link),
    7. information about the user's browser.
  2. The collected logs are stored for the period necessary to ensure the security and proper functioning of the Service, in accordance with the rules of the shop platform provider, as auxiliary material used to administer the Service. The information contained in them is not disclosed to anyone other than persons authorised to administer the Service. Statistics may be generated on the basis of log files to assist in administering the Service. Aggregated summaries in the form of such statistics do not contain any features identifying visitors to the service.
  3. The Controller processes the information contained in the logs for technical and administrative purposes, to ensure the security of the IT system and to manage that system, as well as for analytical and statistical purposes – in this respect, the legal basis for processing Personal data is the Controller's legitimate interest (Article 6(1)(f) GDPR).

§9 – Transfer of data outside the EEA

  1. When the Controller uses tools supporting its day-to-day business, provided e.g. by Google, Users' personal data may be transferred to countries outside the European Economic Area (EEA), in particular to the United States of America (USA), or made available to entities processing data in such countries. Data is transferred outside the EEA in compliance with the requirements of Chapter V GDPR, in particular on the basis of a European Commission decision finding an adequate level of data protection, including the decision on the EU–US Data Privacy Framework – to the extent it applies to the given data recipient – or with appropriate safeguards, in particular standard contractual clauses adopted by the European Commission.

§10 – Final provisions

  1. This privacy policy is subject to updates in connection with the ongoing analysis of the technical and legal conditions relating to the processing of personal data.
  2. This privacy policy applies from 26.10.2026.