Privacy Policy

PRIVACY POLICY OF THE ONLINE STORE OF MY ALPACA SP. Z O.O.

The Controller of your personal data is My Alpaca sp. z o.o. with its registered office in Krosno (postal code: 38-400), ul. Pużaka 18, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court in Rzeszów, 12th Commercial Division of the National Court Register, under KRS number 0000524208, Tax Identification Number (NIP) 6842639013, National Business Registry Number (REGON) 181151572, with a share capital of PLN 600,000 ("PDC" or "Controller").

You can contact the PDC by email: craft@myalpaca.eu

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the "GDPR."

You have the right to request: a. access to your personal data, including obtaining a copy of your data (Article 15 of the GDPR or, if applicable, Article 13(1)(f) of the GDPR), b. rectification (Article 16 of the GDPR), c. erasure (Article 17 of the GDPR), d. restriction of processing (Article 18 of the GDPR), e. transfer of your data to another controller (Article 20 of the GDPR).

You also have the right to: a. object at any time to the processing of your data: - for reasons relating to your particular situation – to the processing of your personal data based on Article 13(1)(f) of the GDPR. Article 6(1)(f) of the GDPR (i.e., - based on our legitimate interests), including profiling (Article 21(1) of the GDPR); - if personal data are processed for direct marketing purposes, including profiling, to the extent that the processing is related to such direct marketing (Article 21(2) of the GDPR).

Contact us if you wish to exercise your rights. You can object to our use of cookies (which you can read about below) by adjusting your browser settings.

If you believe that your data is being processed unlawfully, you can file a complaint with the President of the Personal Data Protection Office.

The Data Controller processes the User's personal data for the following purposes:

1. Fulfilling the User's Order

2. Contacting the User

3. Creating an Account in the Store

4. Handling Complaints and Withdrawal Statements

5. Collecting Product Reviews and Comments

6. Accounting and Tax Purposes

7. Newsletter

8. Marketing Purposes

9. Analysis and Statistics of Sales in the Store

1. To fulfill the order, the User must provide the following data in the order form: first name, last name, delivery address, telephone number, email address, customer identification and contact details. Details and history of the order fulfillment.

2. The basis for processing the above data is the performance of the sales contract (Article 6, paragraph 1, letter b of the GDPR) and the legal obligation related to accounting, which obliges us to process the User's personal data (Article 6, paragraph 1, letter c of the GDPR).

3. The Data Controller may contact the User by telephone or electronically for the purpose of fulfilling the contract.

4. Providing your data is voluntary, but failure to provide it will prevent the Data Controller from fulfilling your order.

Your personal data will be processed for the duration of your order and then for the duration of your rights to file a complaint and exercise your right of withdrawal, until our legal obligation related to accounting expires. Furthermore, your data will be processed until the expiry of the period during which you can pursue claims.

1. To handle inquiries or notifications and to fulfill your order.

2. The basis for processing the above data is the contract or actions taken at your request, aimed at concluding it (Article 6, paragraph 1, letter b of the GDPR) – if your inquiry or notification concerns a contract to which the Data Controller is or may be a party, and the Data Controller's legitimate interest in processing your data for communication purposes (Article 6, paragraph 1, letter f of the GDPR).

3. The Data Controller may contact you by telephone or electronically to fulfill the contract.

4. Providing your data is voluntary, but failure to provide it will prevent the Data Controller from fulfilling your order.

5. Personal data will be processed for the duration of the binding contract or – if no contract is concluded – until the expiry of the claims enforcement period.

1. To create an account, the user must provide the following data in the form: first name, last name, delivery address, telephone number, email address, company name, and Tax Identification Number (NIP) for the purpose of issuing a VAT invoice.

2. The basis for processing the above data is the performance of the contract for the provision of account management services in the Store, a service contract (Article 6, paragraph 1, letter b of the GDPR).

3. The Data Controller may contact the user by telephone or electronically to perform the contract.

4. Providing data is voluntary, however, failure to provide it will prevent the Data Controller from completing the order.

5. Personal data will be processed for the duration of the contract. In addition, the data will be processed until the expiry of the period during which claims can be pursued.

1. To process a complaint or exercise the right of withdrawal, the user must provide the following data in the order form: first name, last name, address, email address, telephone number, and bank account number.

2. The basis for processing the aforementioned data is the fulfillment by the Data Controller of its legal obligation to process complaints or rights - Article 6, paragraph 1, letter f. of the GDPR.

3. Providing data is voluntary, however, failure to provide it will prevent the user from exercising the right to complain or withdraw from the contract.

4. The user's personal data is archived for evidentiary purposes. Furthermore, the data will be processed until the expiry of the period during which claims can be pursued.

1. For the purpose of collecting opinions and comments about products, such as the content of the opinion or comment and the identification data of the person submitting/publishing the opinion/comment.

2. The basis for processing the aforementioned data is the user's consent, expressed by submitting and/or publishing the opinion and/or comment - Article 6, paragraph 1, letter a. of the GDPR.

3. Providing data is voluntary.

4. The user's personal data is stored by a third-party provider until the user requests their deletion.

1. For the purpose of sending the newsletter and analyzing the effectiveness of the content sent, in order to establish general principles for the effective sending of messages within our business.

2. The basis for processing the above data is the agreement for the provision of the newsletter service (Article 6, paragraph 1, letter b of the GDPR) and the legitimate interest of the Data Controller in processing the data for the above-mentioned purpose (Article 6, paragraph 1, letter f of the GDPR).

3. Providing the data is voluntary.

4. The user's personal data is stored until you unsubscribe from our service and we consider your objection to processing. Furthermore, the data will be processed until the expiry of the period during which claims can be pursued.

1. For the purpose of sending marketing information (e.g., information about special offers), data on the browsing history of the Store's content, purchase history, demographic characteristics (age, gender, etc.), and other characteristics of the target groups (customer segments) are collected.

2. The basis for processing the above-mentioned data is the user's consent to marketing activities (Article 6, Section 1, Letter a of the GDPR) and the legitimate interest of the Data Controller in processing the data for the above-mentioned purpose (Article 6, Section 1, Letter f of the GDPR).

3. Providing the data is voluntary.

4. The user's personal data is stored until the user withdraws consent and the objection to processing by the Data Controller is upheld. Data processing remains lawful until the user withdraws consent.

1. The Data Controller does not sell users' personal data to any third parties.

2. Upon request from authorized bodies or institutions, including state bodies or institutions, the Data Controller will share personal data with these bodies or institutions.

3. The Data Controller entrusts the processing of users' personal data to the following entities:

a. nazwa.pl Sp. z o.o., Mieczysława Medweckiego 17, 31-870 Kraków, NIP: 6751402920, REGON: 120805512 - for the purpose of using hosting services,

b. Comarch S.A. with its registered office in Kraków, Aleja Jana Pawła II 39a, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court of Kraków-Śródmieście, in Kraków, 19th Commercial Division of the National Court Register, under KRS number: 0000057567, NIP: 6770065406, REGON: 010771280 - for the purpose of issuing accounting documents,

c. CONTAB Sp. z o.o., ul. Lwowska 17, 38-400 Krosno - for the purpose of using accounting services.

d. SHOPER S.A. with its registered office at ul. Pawia 9, 31-154 Kraków, entered into the register of entrepreneurs of the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register, KRS number 0000395171; Tax Identification Number (NIP): 9452156998 and National Business Registry Number (REGON): 121495203 – for the purpose of processing orders.

e. BASELINKER Sp. z o.o., with its registered office at 15 Solny Square, 50-062 Wrocław, entered into the Register of Entrepreneurs of the District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division of the National Court Register, KRS number: 0000795513; Tax Identification Number (NIP): 8971868567 and National Business Registry Number (REGON): 383907714 – for the purpose of processing orders.

f. POLKURIER – MAGNAT NET Sp. z o.o. sp. k. with its registered office in Ostrów Wielkopolski (address: ul. Kaliska 35a/21; 63-400 Ostrów Wielkopolski), entered into the Register of Entrepreneurs of the National Court Register under KRS number 0000472119; registry court where the company's documentation is kept: District Court Poznań-Nowe Miasto and Wilda in Poznań, 9th Commercial Division – KRS 0000472119; Tax Identification Number (NIP): 6222783796 and National Business Registry Number (REGON): 302504646 – for the purpose of delivering goods.

g. DPD Polska Sp. z o.o. with its registered office in Warsaw at ul. Mineralna 5, 02-274 Warsaw, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court for the capital city of Warsaw, XIVth Commercial Division of the National Court Register under KRS number 0000028368, Tax Identification Number (NIP): 5260204110, National Business Registry Number (REGON): 012026421 – for the purpose of delivering goods.

h. BL Paczka Logistics Sp. z o.o. with its registered office in Warsaw at ul. Czerska 8/10, 00-732 Warsaw, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court for the capital city of Warsaw in Warsaw, XIIIth Commercial Division of the National Court Register under KRS number 0000975638, Tax Identification Number (NIP): 5213971463, National Business Registry Number (REGON): 522241892 – for the purpose of delivering goods.

i. UPS Polska Sp. z o.o. with its registered office in Warsaw, ul. Prądzyńskiego 1/3, 01-222 Warsaw, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court for the capital city of Warsaw in Warsaw, XIIth Commercial Division of the National Court Register under KRS number: 0000036680, Tax Identification Number (NIP): 5221004200, National Business Registry Number (REGON): 010771280 – for the purpose of delivering goods.

j. InPost Sp. z o.o. with its registered office in Kraków, ul. Pana Tadeusza 4, 30-727 Kraków, entered into the Register of Entrepreneurs maintained by the District Court for Kraków-Śródmieście, XIth Commercial Division of the National Court Register under KRS number 0000543759, Tax Identification Number (NIP): 6793108059 – for the purpose of delivering goods.

k. Trusted Shops Poland Sp. z o.o. with its registered office in Warsaw, Skierniewicka 10a, 01-230 Warsaw, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court for the capital city of Warsaw, under KRS number 0000744076, Tax Identification Number (NIP): 5252759135, National Business Registry Number (REGON): 380969749 – for the purpose of providing the Trusted Shops guarantee and collecting opinions and comments.

l. GetResponse S.A. with its registered office in Gdańsk (80-309), at Aleja Grunwaldzka 413, entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court for Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register, under KRS number: 0000942075, Tax Identification Number (NIP): 9581468984 – for email marketing activities.

4. The Data Controller entrusts data to the above-mentioned entities under personal data processing agreements.

To protect users' personal data, the Data Controller has implemented internal documentation regarding personal data protection.

1. The Store does not automatically collect any information, except for the information contained in cookies.

2. Cookies are computer data, specifically text files, stored on the Website User's end device and are intended for use with the Website's websites. Cookies typically contain the name of the website from which they originate, their storage time on the device, and a unique number. By using the appropriate browser options, the user can at any time: - delete cookies, - block the use of cookies in the future.

In such cases, the Data Controller will no longer process them.

3. The entity that places cookies on the User's end device and obtains access to them is the Store operator, i.e. the Data Controller.

4. Cookies are used to:

a. customize the content of the Store's websites to the User's preferences and optimize the use of the websites; in particular, these files allow the Store User's device to be recognized and the website to be displayed appropriately, tailored to their individual needs;

b. creating statistics that help us understand how Store Users use websites, which allows us to improve their structure and content;

c. maintaining the User's session (after logging in), so that the User does not have to re-enter their login and password on each subpage of the Website;

d. marketing

5. The Store uses two basic types of cookies: "session cookies" and "persistent cookies." "Session cookies" are temporary files that are stored on the User's end device until they log out, leave the website, or disable the software (web browser). "Persistent" cookies are stored on the User's end device for the time specified in the cookie parameters or until they are deleted by the User.

6. The Store uses the following types of cookies:

a. "essential" cookies, enabling the use of services available on the Website;

b. cookies used to ensure security;

c. "performance" cookies, enabling the collection of information about how the Website's web pages are used;

d. "functional" cookies, which enable the "remembering" of settings selected by the User and personalization of the User interface;

e. "advertising" cookies, which enable the delivery of advertising content to Users that is more tailored to their interests.

7. The basis for the use of cookies by the Data Controller is the user's consent.

8. The Data Controller also records server logs, i.e., IP address, date and time, information about the system and browser used.

9. A list of analytical and advertising tools that use cookies is included in Appendix 1 below.

ANNEX 1 TO THE My Alpaca STORE PRIVACY POLICY - LIST OF ANALYTICAL AND ADVERTISING TOOLS USING COOKIES

ANALYTICAL COOKIES:

1. We use Google Analytics

a. The information Google Analytics collects about users includes: how many times a user visits the website; which subpages they visit; the date of the first and last visit; the duration of the visit; the page from which the user came (the source); the browser the user uses; the link that was clicked; the location in the world from which the user is accessing the website; the anonymized (shortened) IP address, etc.

b. Google assigns its own identifier (so-called Google ID) to individual users and stores data obtained from cookies from various websites on its servers. We – as the owner of the Website – may receive reports (statistics) from Google related solely to the traffic on our Website. These reports, of course, only cover people who have consented to Google Analytics recording their visits to our Website.

c. You can find further detailed information about how Google Analytics works here and here.

d. You can also permanently prevent Google Analytics from recording information from your browser by installing a special plug-in found here.

2. Cookies from our Store's software provider

a. The software provider that powers our Store – i.e., the owner of the shoper.pl platform – places cookies on our Website to collect aggregate information about how customers use our online stores (subpages opened and how long they spend on them, products displayed, clicks on the Store's website, and analytical information about purchases, such as conversion rates).

b. This data is used to create aggregate reports for online store owners, containing general (non-personal) information, including information about which products interest customers of a given store, which times of the year experience increased traffic or sales, etc. This allows retailers (including us) to improve their stores and optimize their sales processes. You can read full information on this topic in the Cookie Policy for Shoper store visitors.

ADVERTISING COOKIES

1. We use Google Ads and other Google advertising tools

a. Google collects data from cookies placed on your device on its servers. This data is collected on all websites where you have allowed Google to use cookies for advertising purposes (including our Website), as well as from ads you have clicked on. Google uses this information to display ads on other websites you visit. Google cookies typically expire after 3 months.

b. As advertisers using Google services, we do not have access to the data from cookies stored on your device, but we can send advertisements to audiences with characteristics we select, for example, to all people who visited our website (or a specific subpage) in the last 7 days. This data serves only as statistical material for us, and we only send advertisements based on aggregate criteria (to specific target groups, not to a specific user).

c. We may also use (as part of our use of Google Marketing Platform) tools to measure the effectiveness of advertising campaigns (e.g., how many people clicked on a given ad over time). You can read more about how Google uses cookies to display ads and how you can manage your ad settings here and here.

2. Meta Conversion Pixel (Facebook and Instagram)

a. We use the so-called "conversion pixel" (remarketing pixel) Meta to manage ads on Facebook and Instagram.

b. If you consent to the use of this cookie on our Website, then this tool allows Meta Platforms to obtain information that you have visited our Website. This information is assigned to your profile on the relevant service, if you have one. If you are not a user of these services, the information is assigned to a "Facebook ID" created for you.

c. This allows us to commission ads on Facebook and Instagram to people who have already visited our Website or individual subpages (remarketing). We then only receive statistical data from Meta Platforms regarding the effectiveness of our ads (e.g., how many people saw our ad, how many clicked on it), without any reference to specific users.

d. If you have a Facebook or Instagram account, we encourage you to read further information about data protection on these services here and here.

e. You can read more about the Meta remarketing pixel here.

3. Email Marketing

a. For newsletter purposes, we use a tool provided by an external company.

b. The email marketing system embeds cookies on our website to display subscription forms and measure the effectiveness of these forms (conversion rate).