PRIVACY POLICY

1. GENERAL PROVISIONS

This document sets out the Privacy Policy for the "CURITE" website and online platform operating at https://curite.store, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
The Platform Operator and data controller is CHARASLAND, with registered office at: ul. Kamieńskiego 134/4, 51-124 Wrocław, NIP: 8971922338, REGON: 525323722, email: alexink.san@proton.me.
The Privacy Policy covers in particular regulations concerning the protection of personal data and the security of other data voluntarily entered into the Platform by the User.
The Policy is informational in nature and constitutes fulfilment of the data controller's information obligation.
The Privacy Policy constitutes an integral annex to the Terms & Conditions of the "CURITE" online platform.

2. DEFINITIONS

Platform – the online trading platform operating at curite.store.
Controller – the entity specified in §1(2) of the Privacy Policy.
User – any person using the Platform and entering their personal data into it.
User Account – a personalised account created by the Seller, through which the Seller may offer their products on the Platform.
Order – a specific purchase made by a Platform User.
Personal data – information about an identified or identifiable natural person within the meaning of Art. 4(1) GDPR.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
Policy or Privacy Policy – this document.
Terms & Conditions – the Terms & Conditions of the "CURITE" online platform operating at https://curite.store.
Seller – a person offering their products on the Platform.

3. SCOPE OF PROCESSED DATA

The Controller may process in particular:

first and last name,
company or organisation name,
business address,
NIP (tax identification number),
PESEL number – only where required by law,
email address,
phone number,
delivery address,
data regarding the selected pickup point (e.g. parcel locker number and location),
invoice data (if required),
Seller data required by law,
content of correspondence conducted through the Platform or by email,
content of conversations with the chat agent,
metadata of messages sent in the chat agent,
User ID and chat agent session identifiers,
technical data (IP address, system logs, device and browser information).

The chat agent does not make decisions producing legal effects for users and does not replace human service. The chat agent serves only as support for Platform operations.

4. PURPOSES AND LEGAL BASES FOR PROCESSING

Personal data is processed for the following purposes:

concluding and performing sales contracts – Art. 6(1)(b) GDPR,
providing electronic services – Art. 6(1)(b) GDPR,
creating and maintaining a User Account on the Platform – Art. 6(1)(b) GDPR,
processing payments and settlements – Art. 6(1)(b) and (c) GDPR,
fulfilling Order delivery, including processing the delivery address or data regarding the pickup point selected by the User (e.g. InPost parcel locker) – Art. 6(1)(b) GDPR,
handling enquiries and communication, conducting correspondence, handling reports, requests, enquiries or processing complaints – Art. 6(1)(f) GDPR,
preventing fraud and ensuring security – Art. 6(1)(f) GDPR,
fulfilling legal obligations (accounting, tax) – Art. 6(1)(c) GDPR,
exercising the right to pursue debt recovery or initiate and/or conduct legal proceedings – Art. 6(1)(f) GDPR,
marketing activities – based on consent only – Art. 6(1)(a) GDPR,
ensuring chat agent operation and responding to user queries – Art. 6(1)(f) GDPR,
personalising content and product recommendations on the Platform and in the chat agent – Art. 6(1)(f) GDPR and Art. 6(1)(a) GDPR (cookies),
analysing service operation for statistical purposes and improving service quality – Art. 6(1)(f) GDPR and Art. 6(1)(a) GDPR (cookies),
in exceptional circumstances, sharing personal data upon requests from public authorities or entities authorised under law – Art. 6(1)(c) GDPR (fulfilment of legal obligations),
creating and storing backups, maintaining the ability to continuously ensure the confidentiality, integrity, availability and resilience of processing systems and services – Art. 6(1)(c) in conjunction with Art. 32(1) GDPR and Art. 6(1)(f) GDPR (the Controller's legitimate interest in ensuring data and system security) in conjunction with Art. 32 GDPR.

The Controller notes that it does not collect data regarding payments made by Platform Users. Payments are processed by third parties, namely through the Stripe platform. This entity has its own personal data processing policy, available at the Stripe Privacy Policy.

5. DATA RECIPIENTS

Personal data may be shared with:

Sellers – exclusively to the extent necessary to fulfil the Order,
payment operators,
delivery service providers – exclusively to the extent necessary to fulfil the Order,
accounting firms,
hosting and email service providers,
data may also be processed in anonymised form for analytical or marketing purposes that do not allow user identification, e.g. Google Analytics, Google Ads etc. The use of analytical and marketing tools is based on user consent expressed through the cookie mechanism,
public authorities – on the basis of applicable law,
law firms.

The Controller does not sell personal data to third parties.

6. DATA TRANSFERS OUTSIDE THE EU

Data may be transferred outside the European Economic Area only to entities providing an adequate level of data protection, in accordance with the GDPR (e.g. on the basis of standard contractual clauses).

7. DATA RETENTION PERIODS

Personal data is stored:

for the duration of the contract and after its termination in accordance with legal obligations (i.e. in particular until the expiry of the statute of limitations for civil law claims),
until the expiry of the obligation to retain data resulting in particular from the obligation to retain accounting documents,
until consent is withdrawn – in the case of data processed on its basis,
content of chat agent user messages – 90 days from the date of sending (may be shortened or extended depending on legal or operational requirements),
anonymous or pseudonymised data for analyses – up to 24 months,
for the period necessary to secure potential claims,
in the event of proceedings initiated by competent authorities – for the entire duration of such proceedings.

8. RIGHTS OF DATA SUBJECTS

Every person has the right to:

access their data,
rectify, erase or restrict the processing of data,
data portability,
object to the processing of data,
withdraw consent to data processing at any time,
lodge a complaint with the President of the Personal Data Protection Office (UODO).

Requests are fulfilled no later than 30 days from receipt.

9. OBLIGATION TO PROVIDE DATA

Providing data is voluntary but necessary to conclude a contract, use certain Platform features, including the chat agent, or fulfil an Order. Failure to provide data may prevent the use of the Platform. Withdrawal of the User's consent to the processing of their personal data does not affect the lawfulness of data processing during the period when the consent was in effect.

10. PROFILING

The Controller does not apply automated decision-making regarding users, including profiling within the meaning of the GDPR.

11. DATA SECURITY

The Controller applies appropriate technical and organisational measures to protect personal data against loss, access by unauthorised persons or unauthorised processing. Communication between the user and the chat agent is secured with SSL protocol.

12. COOKIES

The Platform uses cookies. Detailed information is available in the Cookie Policy.

13. CHANGES TO THE PRIVACY POLICY

The Controller may update the Privacy Policy. The current version is always available on the Platform.

14. CONTACT

For matters relating to personal data protection, please contact the Controller at: support@curite.store.