PURPOSE OF PROCESSING AND LEGAL BASIS
The Administrator processes the personal data of the Store’s Service Users at www.lawkiorganic.com in the following cases:

• Account registration in the Store – for the purpose of creating and managing an individual account, pursuant to Article 6(1)(b) of the GDPR (performance of a contract for the provision of electronic services in accordance with the Store’s Terms and Conditions).

• Placing an Order in the Store – for the purpose of performing the Sales Agreement, pursuant to Article 6(1)(b) of the GDPR (performance of a sales contract).

• Newsletter subscription – for the purpose of sending commercial information by electronic means. Personal data is processed after obtaining separate consent, pursuant to Article 6(1)(a) of the GDPR.

• Using the Review System – to enable the Customer to express their opinion about the Product purchased in the Store and the Sales Agreement concluded with the Seller, pursuant to Article 6(1)(f) of the GDPR (legitimate interest of the entrepreneur).

• Using the Contact Form – for the purpose of sending a message to the Administrator, pursuant to Article 6(1)(f) of the GDPR (legitimate interest of the entrepreneur).

TYPE OF PERSONAL DATA PROCESSED
The Service User provides the following data in the case of:

• Account: email address

• Order: first name and surname, address, Tax Identification Number (NIP), email address, phone number

• Newsletter: first name and surname, email address

• Review System: first name and surname, email address

• Contact Form: first name and surname, email address, phone number

DATA RETENTION PERIOD
The personal data of Service Users is stored by the Administrator:

• When processing is based on contract performance – for as long as necessary to perform the contract, and thereafter for a period corresponding to the limitation period for claims. Unless otherwise provided by specific regulations, the limitation period is six years, and for claims concerning periodic benefits and claims related to business activities – three years.

• When processing is based on consent – until the consent is withdrawn, and after its withdrawal for a period corresponding to the limitation period for claims that may be raised by or against the Administrator. Unless otherwise provided by specific regulations, the limitation period is six years, and for claims concerning periodic benefits and claims related to business activities – three years.

While using the Store, additional information may be collected, in particular: the IP address assigned to the Service User’s computer or the external IP address of the Internet provider, domain name, browser type, access time, and operating system type.

After giving separate consent pursuant to Article 6(1)(a) of the GDPR, data may also be processed for the purpose of sending commercial information by electronic means or making telephone calls for direct marketing purposes – respectively in connection with Article 10(2) of the Act of 18 July 2002 on the Provision of Electronic Services or Article 172(1) of the Act of 16 July 2004 – Telecommunications Law, including marketing carried out as a result of profiling, provided that the Service User has given appropriate consent.

Navigation data may also be collected from Service Users, including information about links and references they choose to click or other activities undertaken in the Store. The legal basis for such activities is the legitimate interest of the Administrator (Article 6(1)(f) of the GDPR), consisting in facilitating the use of services provided electronically and improving the functionality of these services.

Providing personal data by the Service User is voluntary.

The Administrator exercises special care to protect the interests of data subjects and, in particular, ensures that the data collected by them are:

• processed lawfully,

• collected for specified, lawful purposes and not further processed in a manner incompatible with those purposes,

• substantively correct and adequate in relation to the purposes for which they are processed, and stored in a form that permits identification of the persons concerned for no longer than is necessary to achieve the purpose of processing.