1. This Privacy Policy sets out the rules for the processing of personal data obtained through the STORY COFFEE ROASTER online shop operating at www.storycoffee.pl (hereinafter: "Online shop").
2. The owner of the Shop and, at the same time, the Administrator of Personal Data is the company PROJEKT KAWA spółka z ograniczoną odpowiedzialnością, based in Warsaw (02-495), on Aleje Jerozolimskie 236, registered in the Register of Entrepreneurs of the National Court Register under the KRS number 0000670491, REGON 36692079000000, NIP 5223087762, with a share capital of 5,000.00 (five thousand) PLN, whose registration files are held by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register.
3. Personal data collected by Projekt Kawa sp. z o.o. via the Online Shop is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), also known as the RODO.
4. Projekt Kawa sp. z o.o. is particularly careful to respect the privacy of Customers visiting the Online Shop.

§ 1 Type of data processed, purposes and legal basis

1. Projekt Kawa sp. z o.o. collects information concerning natural persons performing a legal action not directly related to their activity, natural persons conducting a business or professional activity on their own behalf and natural persons representing legal persons or organisational units which are not legal persons and to which the law grants legal capacity, hereinafter collectively referred to as Clients.
2. Customers' personal data are collected in the event of:
   
   1. register an account with the Online Shop, in order to create and manage an individual account. Legal basis: the data are necessary for the performance of the contract for the provision of the Account service (Art. 6(1)(b) RODO);
   2. placing an order in the Online Shop, for the purpose of fulfilling the sales contract. Legal basis: the data are necessary for the performance of the sales contract (Art. 6(1)(b) RODO);
   3. the use of the contact form service in the Online Shop for the performance of the contract provided electronically. Legal basis: the data are necessary for the performance of the contract for the provision of the contact form service (Art. 6(1)(b) RODO);
   4. the use of the Post an Opinion service, for the performance of the contract for electronically supplied services. Legal basis: the data are necessary for the performance of the contract for the Post an Opinion service (Art. 6(1)(b) RODO).
3. When registering an account with the Online Shop, the Customer shall specify:
   
   1. e-mail address;
   2. name;
   3. telephone number.
4. When registering an account with the Online Shop, the Customer independently sets an individual password to access his/her account. The Customer may change the password, at a later date, according to the principles described in § 5.
5. When placing an order in the Online Shop, the Customer provides the following data:
   
   1. e-mail address;
   2. address details:
   3. postcode and town;
   4. street with house/apartment number.
   5. name;
   6. telephone number.
6. In the case of Entrepreneurs, the above data scope is further extended to include:
   
   1. the entrepreneur's company;
   2. NIP number.
7. When using the contact form service, the Customer provides the following data:
   
   1. e-mail address;
   2. name;
   3. telephone number.
8. When using the Post a Review service, the customer provides only his or her nickname, nickname or first name.
9. When using the Shop's Website, additional information may be collected, in particular: the IP address assigned to the Customer's computer or the external IP address of the Internet provider, domain name, browser type, access time, operating system type.
10. Navigation data may also be collected from Customers, including information about links and references they choose to click on or other actions they take in the Online Shop. Legal basis - legitimate interest (Article 6(1)(f) RODO), consisting of facilitating the use of the electronically provided services and improving the functionality of these services.
11. For the purpose of establishing, investigating and enforcing claims, certain personal data provided by the Customer as part of the use of the functionality on the Online Shop may be processed, such as: name, surname, data on the use of the services if the claims arise from the way the Customer uses the services, other data necessary to prove the existence of the claim, including the extent of the damage suffered. Legal basis - the legitimate interest of the controller (Article 6(1)(f) RODO) to establish, assert and enforce claims and to defend against claims in proceedings before courts and other state authorities.
12. Transfer of personal data to Projekt Kawa sp. z o.o.  is voluntary, in relation to concluded sales contracts or the provision of services via the Shop's Website, with the proviso, however, that failure to provide the data specified in the forms during the Registration process makes it impossible to register and set up a Customer Account, and in the case of placing an order without registering a Customer Account, it will make it impossible to place and carry out the Customer's order.

§ 2 To whom are the data made available or entrusted and how long are they stored?

1. The Customer's personal data is provided to service providers used by Projekt Kawa sp. z o.o. in the operation of the Online Shop. Service providers to whom personal data is transferred, depending on contractual arrangements and circumstances, either are subject to the instructions of Projekt Kawa sp. z o.o.  as to the purposes and means of processing those data (processors) or they themselves determine the purposes and means of processing (controllers).
2. Location. Service providers are based in Poland and other countries in the European Economic Area (EEA).
3. Customers' personal data is stored:
   
   1. where personal data processing is based on consent, the Customer's personal data is processed by Projekt Kawa sp. z o.o.  as long as the consent is not revoked, and after revocation of the consent for a period of time corresponding to the period of limitation of claims which Projekt Kawa sp. z o.o. may raise and which may be raised against it. Unless a special provision provides otherwise, the limitation period is six years, and three years for claims for periodic benefits and claims related to the conduct of business.
   2. where the basis for data processing is the performance of a contract, then the Customer's personal data is processed by Projekt Kawa sp. z o.o.  for as long as is necessary for the performance of the contract and thereafter for a period corresponding to the period of limitation of actions. Unless otherwise provided by a special provision, the limitation period shall be six years, and for periodic performance claims and claims relating to the conduct of business, three years.
4. If you make a purchase from the Online Shop, your personal data may be transferred to a courier company for the delivery of the ordered goods.
5. In the event that the Customer chooses to pay via the PayU system, his/her personal data are transferred to the extent necessary for the execution of the payment to PayU S.A. with its seat in Poznan, 60-166 Poznan, at ul. Grunwaldzka 186, entered in the register of entrepreneurs kept by the District Court in Poznań - Nowe Miasto and Wilda in Poznań, VIII Commercial Department of the National Court Register under KRS number 0000274399, NIP 779-23-08-495, with the share capital of PLN 4,944,000, paid in full; a domestic payment institution supervised by the Polish Financial Supervision Authority, entered in the Payment Services Register under number IP1/2012.
6. Navigation data may be used to provide better service to customers, to analyse statistical data and to adapt the Online Shop to customers' preferences, as well as to administer the Online Shop.
7. If an appropriate request is made, Projekt Kawa sp. z o.o. makes personal data available to authorised state authorities, in particular to organisational units of the Prosecutor's Office, the Police, the President of the Office for Personal Data Protection, the President of the Office for Competition and Consumer Protection or the President of the Office of Electronic Communications.

§ 3 Cookie mechanism, IP address

1. The Online Shop uses small files, known as cookies. These are stored by Projekt Kawa sp. z o.o. on the end device of the person visiting the Online Shop, if the web browser allows it. A cookie file usually contains the name of the domain from which it originates, its "expiry time" and an individual random number identifying the file. Information collected by means of files of this type helps to adapt the products offered by Projekt Kawa sp. z o.o. to the individual preferences and real needs of visitors to the Internet Shop. They also provide the possibility of developing general statistics on the visits to the presented products in the Internet Shop.
2. Projekt Kawa sp. z o.o. uses two types of cookies:
   
   1. Session cookies: when the session of a particular browser ends or the computer is switched off, the stored information is deleted from the device's memory. The mechanism of session cookies does not allow the collection of any personal data or any confidential information from the Clients' computers.
   2. Persistent cookiesThe cookies are stored in the memory of the Customer's terminal equipment and remain there until they are deleted or expire. The mechanism of permanent cookies does not allow any personal data or any confidential information to be retrieved from the Customers' computer.
3. Projekt Kawa sp. z o.o.  uses cookies for the following purposes:
   
   1. to authenticate the Customer in the Internet Shop and ensure a Customer session in the Internet Shop (after logging in), thanks to which the Customer does not have to re-enter his/her login and password on each sub-page of the Internet Shop;
   2. analysis and research, as well as audience auditing, and in particular to create anonymous statistics that help to understand how Customers use the Store's Website, so as to improve its structure and content.
4. Projekt Kawa sp. z o.o. uses external cookies in order to: present on the information pages of the Shop, a map indicating the location of the Projekt Kawa sp. z o.o. office by means of the maps.google.com website (administrator of external cookies: Google Inc. based in the USA);
5. The cookie mechanism is safe for the computers of the Customers of the Internet Shop. In particular, it is not possible for viruses or other unwanted software or malware to get into Customers' computers via this method. Nevertheless, Customers have the option in their browsers to limit or disable access of cookies to their computers. If this option is used, the use of the Online Shop will be possible, except for functions that by their nature require cookies.
6. Projekt Kawa sp. z o.o. may collect Customers' IP addresses. An IP address is a number assigned to the computer of a person visiting the Internet Shop by an Internet service provider. The IP number enables access to the Internet. In most cases, it is assigned to the computer dynamically, i.e. it changes each time the computer is connected to the Internet. The IP address is used by Projekt Kawa sp. z o.o. to diagnose technical problems with the server, to create statistical analyses (e.g. to determine from which regions we record the highest number of visits), as information useful for administration and improvement of the Internet Shop, as well as for security purposes and possible identification of unwanted automatic programmes overloading the server for browsing the contents of the Internet Shop.
7. The online shop contains links and references to other websites. Projekt Kawa sp. z o.o.  is not responsible for their privacy practices.

§ 4 Data subject rights

1. Right of withdrawal of consent - legal basis: Article 7(3) RODO.
   
   1. The customer has the right to withdraw any consent given by Projekt Kawa sp. z o.o..
   2. Withdrawal of consent has effect from the moment of withdrawal.
   3. The withdrawal of consent does not affect the processing carried out by Projekt Kawa sp. z o.o. in accordance with the law prior to its withdrawal.
   4. Withdrawal of consent does not entail any negative consequences for the Customer, however, it may prevent further use of services or functionalities which, according to the law, Projekt Kawa sp. z o.o. can only provide with consent.
2. Right to object to the processing of data - legal basis: Article 21 RODO.
   
   1. The customer has the right to object at any time - for reasons related to his or her particular situation - to the processing of his or her personal data, including profiling, if Projekt Kawa sp. z o.o. processes his or her data on the basis of a legally justified interest, e.g. marketing of products and services of Projekt Kawa sp. z o.o., keeping statistics on the use of particular functionalities of the Internet Shop and facilitating the use of the Internet Shop, as well as satisfaction surveys.
   2. Opting out, in the form of an email, of receiving marketing communications about products or services will imply the Customer's objection to the processing of his/her personal data, including profiling for these purposes.
   3. If the Customer's objection proves to be legitimate and Projekt Kawa sp. z o.o. has no other legal basis for processing the personal data, the Customer's personal data will be deleted against the processing of which the Customer has objected.
3. Right to erasure ("right to be forgotten") - legal basis: Article 17 RODO.
   
   1. The customer has the right to request the deletion of all or some personal data.
   2. The customer has the right to request the deletion of personal data if:
      
      1. personal data are no longer necessary for the purposes for which they were collected or for which they were processed;
      2. has withdrawn specific consent, to the extent that personal data were processed on the basis of his or her consent;
      3. has objected to the use of his or her data for marketing purposes;
      4. personal data are processed unlawfully;
      5. personal data must be erased in order to comply with a legal obligation under Union law or the law of a Member State to which Projekt Kawa sp. z o.o. is subject;
      6. personal data was collected in connection with the offering of information society services.
   3. Despite a request for deletion of personal data, due to an objection or withdrawal of consent, Projekt Kawa sp. z o.o. may retain certain personal data to the extent that the processing is necessary to establish, assert or defend claims, as well as to comply with a legal obligation requiring processing under Union or Member State law to which Projekt Kawa sp. z o.o. is subject. This applies in particular to personal data such as: name, surname, e-mail address, which data is saved for the purpose of handling complaints and claims related to the use of services of Projekt Kawa sp. z o.o., or additionally home address / correspondence address, order number, which data is saved for the purpose of handling complaints and claims related to concluded sales contracts or provision of services.
4. Right to restrict data processing - legal basis: Article 18 RODO.
   
   1. The Customer has the right to request the restriction of the processing of his/her personal data. The submission of a request, until it is considered, prevents the use of certain functionalities or services, the use of which will involve the processing of data covered by the request. Projekt Kawa sp. z o.o. will also not send any communications, including marketing communications.
   2. The customer has the right to request the restriction of the use of personal data in the following cases:
      
      1. when he/she questions the correctness of his/her personal data - then Projekt Kawa sp. z o.o. restricts its use for the time necessary to verify the correctness of the data, but no longer than for 7 days;
      2. when the processing of the data is unlawful, and instead of deleting the data, the Customer requests the restriction of its use;
      3. when the personal data is no longer necessary for the purposes for which it was collected or used but is needed by the Customer to establish, assert or defend a claim;
      4. when he/she has objected to the use of his/her data, in which case the restriction shall be for the time necessary to consider whether, due to the particular situation, the protection of the Client's interests, rights and freedoms outweighs the interests pursued by the Administrator in processing the Client's personal data.
5. Right of access to data - legal basis: Article 15 RODO.
   
   1. The Customer has the right to obtain confirmation from the Administrator as to whether it is processing personal data and, if so, the Customer has the right:
      
      1. access your personal data;
      2. obtain information about the purposes of the processing, the categories of personal data processed, the recipients or categories of recipients of such data, the intended period of storage of the Customer's data or the criteria for determining that period (where it is not possible to determine the intended period of processing), the Customer's rights under the RODO and the right to lodge a complaint with a supervisory authority, the source of such data, automated decision-making, including profiling, and the safeguards applied in connection with the transfer of such data outside the European Union;
      3. obtain a copy of your personal data.
6. Right of rectification - legal basis: Article 16 RODO.
   
   1. The Customer has the right to request from the Administrator the immediate rectification of personal data concerning him/her that is incorrect. Taking into account the purposes of the processing, the Data Subject Customer has the right to request the completion of incomplete personal data, including by providing an additional statement, by addressing a request to the e-mail address in accordance with § 6 of the Privacy Policy.
7. Right to data portability - legal basis: Article 20 RODO.
   
   1. The Customer has the right to receive his/her personal data that he/she has provided to the Administrator and then send it to another personal data controller of his/her choice. The Customer also has the right to request that the personal data be sent by the Administrator directly to such controller, insofar as this is technically possible. In this case, the Administrator will send the Customer's personal data in the form of a file in csv format, which is a commonly used, machine-readable format that allows for the transmission of the received data to another personal data controller.
   2. In the situation when the Client makes a demand resulting from the above-mentioned rights, Projekt Kawa sp. z o.o. meets the demand or refuses to meet it immediately, but no later than within one month after receiving it. However, if - due to the complicated nature of the request or the number of requests, Projekt Kawa sp. z o.o. will not be able to meet the request within one month, it will meet it within another two months informing the Client in advance - within one month of receiving the request - about the intended extension of the deadline and the reasons for it.
   3. The Customer may lodge complaints, queries and requests with the Administrator regarding the processing of his/her personal data and the exercise of his/her rights.
   4. Customer  has the right to request a copy of the standard contractual clauses from Projekt Kawa sp. z o.o. by directing an enquiry as indicated in § 6 of the Privacy Policy.
   5. The customer has the right to lodge a complaint with the President of the Office for Personal Data Protection regarding a breach of his/her data protection rights or other rights granted under the RODO.

§ 5 Security management - Password

1.  

1. Projekt Kawa sp. z o.o. provides Customers with a secure and encrypted connection when sending personal data and when logging into the Customer's Account on the Website. Projekt Kawa sp. z o.o. uses an SSL certificate issued by one of the world's leading companies in the field of security and encryption of data transmitted over the Internet.
2. If a Customer with an account in the Online Shop has lost his/her password in any way, the Online Shop enables the generation of a new password. Projekt Kawa sp. z o.o. does not send password reminders. The password is stored in an encrypted form in such a way that it cannot be read. In order to generate a new password, the e-mail address should be provided in the form available under the link "Forgotten your password ?", given at the log-in form for the account in the Internet Shop. The Customer shall receive an e-mail message to the e-mail address provided during registration or saved in the last change of the account profile, containing a redirection to a dedicated form available on the Store's Website, where the Customer will have the opportunity to set a new password.
3. Projekt Kawa sp. z o.o. never sends any correspondence, including electronic correspondence, requesting login details and in particular the password to access the Client's account.

§ 6 Changes to the Privacy Policy

1. 1.  

1. The Privacy Policy is subject to change, of which Projekt Kawa sp. z o.o. will inform Customers 7 days in advance.
2. Please direct any questions relating to the Privacy Policy to: [email protected]
3. Date of last modification: 15.04.2023r.