Privacy policy

PRIVACY POLICY OF THE ONLINE STORE

WWW.GEOSHOTPADEL.COM

§ 1

GENERAL PROVISIONS

  1. The controller of personal data collected through the online store www.geoshotpadel.com is Giovanni Marra, conducting business under the name Geo Shot - Giovanni Marra, entered into the Central Registration and Information on Business (CEIDG) of the Republic of Poland kept by the minister responsible for economy, place of business and address for service: ul. Ceramiczna 5c/46, 03-126 Warsaw, Poland, NIP: 5242876193, REGON: 381687929, e-mail address: info@geoshotpadel.com, telephone number: +48 690432583, hereinafter referred to as the "Controller" and also the "Service Provider."
  2. Personal data collected by the Controller via the website are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as GDPR.
  3. Any terms or expressions written in this Privacy Policy with a capital letter shall be understood in accordance with their definition contained in the online Store terms and conditions www.geoshotpadel.com.

§ 2

TYPE OF PERSONAL DATA PROCESSED, PURPOSE, AND SCOPE OF DATA COLLECTION

  1. PURPOSE OF PROCESSING AND LEGAL BASIS. The Controller processes personal data of the Service Recipients of the www.geoshotpadel.com store in the case of:

1.1. registration of an Account in the Store, for the purpose of creating an individual account and managing that Account, based on Art. 6(1)(b) of the GDPR (performance of a contract for the provision of electronic services in accordance with the Store terms and conditions);

1.2. placing an order in the Store, for the purpose of performing a sales contract, based on Art. 6(1)(b) of the GDPR (performance of a sales contract).

  1. TYPE OF PERSONAL DATA PROCESSED. The Service Recipient provides, in the case of:

2.1.Account: name and surname, login, e-mail address.

2.2. Order: name and surname, address, Tax Identification Number (NIP), e-mail address, telephone number.

  1. PERSONAL DATA ARCHIVING PERIOD. Personal data of Service Recipients are stored by the Controller:

3.1. where the basis for data processing is the performance of a contract: as long as it is necessary to perform the contract, and thereafter for a period corresponding to the limitation period for claims. Unless a special provision states otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to conducting business activity – three years.

3.2. where the basis for data processing is consent: until the consent is withdrawn, and after the withdrawal of consent for a period of time corresponding to the limitation period for claims that the Controller may raise and that may be raised against the Controller. Unless a special provision states otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to conducting business activity – three years.

  1. While using the Store, additional information may be collected, in particular: the IP address assigned to the Service Recipient's computer or the external IP address of the Internet provider, domain name, browser type, access time, and operating system type.
  2. Upon separate consent, based on Art. 6(1)(a) of the GDPR, data may also be processed for the purpose of sending commercial information by electronic means or making telephone calls for direct marketing purposes – respectively in connection with Art. 398(1) and (2) of the Act of 12 July 2024 - Electronic Communications Law, including those directed as a result of profiling, provided that the Service Recipient has given appropriate consent.
  3. As part of the User's activity in the Store, profiling may take place, which aims to select appropriate advertising content to be directed to the User.
  4. Profiling means any form of automated processing of personal data consisting IN the use of personal data to evaluate certain personal factors of a natural person, in particular to analyze or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. Profiling does not produce legal effects for the Service Recipient nor does it significantly affect their situation in any other way. Its purpose is only to better tailor marketing content and offers.
  5. Navigation data may also be collected from Service Recipients, including information about links and references they decide to click on or other activities undertaken in the Store. The legal basis for this type of activity is the legitimate interest of the Controller (Art. 6(1)(f) of the GDPR), consisting in facilitating the use of services provided electronically and improving the functionality of these services.
  6. Providing personal data by the Service Recipient is voluntary but necessary to use the Electronic Services and conclude a Sales Agreement. 
  7. The Controller shall exercise special care to protect the interests of the data subjects and, in particular, ensures that the data collected are:

10.1. processed lawfully;

10.2. collected for specified, lawful purposes and not subjected to further processing incompatible with those purposes;

10.3. factually correct and adequate in relation to the purposes for which they are processed and stored in a form that permits identification of the data subjects for no longer than is necessary to achieve the purpose of processing.


§ 3

DISCLOSURE OF PERSONAL DATA

  1. Personal data of Service Recipients are transferred to service providers used by the Controller in operating the Store, in particular to:

1.1. entities providing Product delivery services;

1.2. payment system providers;

1.3. accounting office;

1.4. hosting provider;

1.5. software providers enabling business operations;

1.6. entities providing mailing systems;

1.7. providers of software required to run an online store.

  1. The service providers referred to in point 1 of this paragraph, to whom personal data are transferred, depending on contractual arrangements and circumstances, either follow the Controller's instructions regarding the purposes and methods of processing such data (processors) or independently determine the purposes and methods of their processing (controllers).
  2. Personal data of Service Recipients are stored exclusively within the European Economic Area (EEA), subject to § 5 point 5 and § 6 of the Privacy Policy.
  3. Personal data may be transferred outside the European Economic Area (EEA), in particular to the United States, in connection with the Controller's use of analytical and marketing tool providers (e.g., Google LLC, Meta Platforms Inc.). Data transfer takes place on the basis of Standard Contractual Clauses (SCC) approved by the European Commission, in accordance with Art. 46(2)(c) of the GDPR.


§ 4

RIGHT OF CONTROL, ACCESS TO OWN DATA, AND RECTIFICATION

  1. The data subject has the right to access the content of their personal data and the right to rectification, erasure, restriction of processing, the right to data portability, the right to object, and the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
  2. Legal basis for the Service Recipient's request:

2.1. Access to data – Art. 15 GDPR.

2.2. Rectification of data – Art. 16 GDPR.

2.3. Erasure of data (right to be forgotten) – Art. 17 GDPR.

2.4. Restriction of processing – Art. 18 GDPR.

2.5. Data portability – Art. 20 GDPR.

2.6. Objection – Art. 21 GDPR.

2.7. Withdrawal of consent – Art. 7(3) GDPR.

  1. To exercise the rights referred to in point 2, an appropriate e-mail may be sent to: info@geoshotpadel.com.
  2. If a Service Recipient exercises any of the aforementioned rights, the Controller shall fulfill the request or refuse to fulfill it immediately, but no later than within one month of receiving it. However, if – due to the complex nature of the request or the number of requests – the Controller is unable to fulfill the request within a month, they shall fulfill it within the following two months, informing the Service Recipient in advance (within one month of receiving the request) of the intended extension and its reasons.
  3. If it is found that the processing of personal data violates the provisions of the GDPR, the data subject has the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO).


§ 5

"COOKIES" FILES

  1. The Controller's website uses "cookies."
  2. The installation of "cookies" is necessary for the proper provision of services on the Store's website. "Cookies" contain information necessary for the correct functioning of the site and allow for the generation of general website visit statistics.
  3. Two types of "cookies" are used on the site: "session" and "persistent."

3.1. ”Session” cookies are temporary files stored on the Service Recipient's end device until logging out (leaving the site).

3.2. ”Persistent” cookies are stored on the Service Recipient's end device for the time specified in the cookie parameters or until deleted by the Service Recipient.

  1. The Controller uses their own cookies to better understand how Service Recipients interact with the site's content. These files collect information about the Service Recipient's use of the website, the type of site from which they were redirected, and the number and duration of visits. This information does not record specific personal data of the Service Recipient but serves to compile website usage statistics.
  2. The Controller also uses external cookies to collect general and anonymous statistical data via Google Analytics (external cookie controller: Google LLC, based in the USA).
  3. Cookies may also be used by advertising networks, in particular the Google network, to display advertisements tailored to the way the Service Recipient uses the Store. For this purpose, they may retain information about the Service Recipient's navigation path or time spent on a given page.
  4. The Service Recipient has the right to decide on the access of "cookies" to their computer by:

7.1. selecting the types of cookies they consent to immediately upon entering the Store's website and when the cookie message appears;

7.2. changing the settings in their browser window. Detailed information on the possibilities and methods of handling "cookies" is also available in the software (web browser) settings.


§ 6

ADDITIONAL SERVICES RELATED TO USER ACTIVITY IN THE STORE

  1. The Store uses so-called social plugins ("plugins") from social networking sites. When displaying the website www.geoshotpadel.com containing such a plugin, the Service Recipient's browser will establish a direct connection with Facebook and Instagram servers.
  2. The content of the plugin is transmitted by the respective provider directly to the Service Recipient's browser and integrated into the page. Through this integration, providers receive information that the Service Recipient's browser has displayed the page www.geoshotpadel.com, even if the Service Recipient does not have a profile with the given provider or is not currently logged in. Such information (along with the Service Recipient's IP address) is sent by the browser directly to the respective provider's server (some servers are located in the USA) and stored there.
  3. If the Service Recipient is logged into one of the above-mentioned social networks, the provider will be able to directly associate the visit to www.geoshotpadel.com with the Service Recipient's profile on that social network.
  4. If the Service Recipient uses a plugin, e.g., by clicking the "Like" or "Share" button, the corresponding information will also be sent directly to the respective provider's server and stored there.
  5. The purpose and scope of data collection and its further processing and use by providers, as well as the possibility of contact and the Service Recipient's rights in this regard and the possibility of configuring settings ensuring the protection of the Service Recipient's privacy, are described in the providers' privacy policies:

5.1. https://www.facebook.com/policy.php

5.2. https://help.instagram.com/519522125107875?helpref=page_content

5.3. https://www.tiktok.com/legal/page/eea/privacy-policy/pl


  1. If the Service Recipient does not want social networks to associate data collected during visits to www.geoshotpadel.com directly with their profile on a given site, they must log out of that site before visiting www.geoshotpadel.com. The Service Recipient can also completely prevent the loading of plugins on the page by using appropriate browser extensions, e.g., script blocking with "NoScript."
  2. The Controller uses remarketing tools on their website, i.e., Google Ads/Google AdWords; this involves the use of Google LLC cookies related to the Google AdWords service. Within the mechanism for managing cookie settings, the Service Recipient has the option to decide whether the Service Provider will be able to use Google Ads/Google AdWords (external cookie controller: Google Inc., based in the USA) in relation to them.


§ 7

FINAL PROVISIONS

  1. The Controller SHALL APPLY technical and organizational measures to ensure the protection of processed personal data appropriate to the risks and categories of protected data, in particular, protecting data against disclosure to unauthorized persons, removal by an unauthorized person, processing in violation of applicable regulations, and rectification, loss, damage, or destruction.
  2. The Controller shall provide appropriate technical measures to prevent unauthorized persons from acquiring and modifying personal data sent electronically.
  3. In matters not regulated by this Privacy Policy, the provisions of the GDPR and other relevant provisions of Polish law shall apply accordingly.
  4. The Controller shall update this Privacy Policy in connection with legal changes or business development. Information about modifications to the Privacy Policy will be posted at least 7 days before it enters into force on the Store's website or sent via e-mail to a Service Recipient who uses Electronic Services provided on a continuous basis (Account, Newsletter).