PRIVACY POLICY OF THE WWW.NAVIN.PL ONLINE STORE

This Privacy Policy (hereinafter: " Policy ") contains information on the processing of your personal data in connection with the use of the online store "NAVIN.PL", operating at the Internet address WWW.NAVIN.PL (hereinafter: " Store ").

All capitalized terms that are not otherwise defined in the Policy have the meaning given to them in the Regulations, available at: Link .

Personal data administrator

The administrator of your personal data is NAVIN PL spółka z ograniczoną odpowiedzialnością with its registered office in Kraków (registered office address: ul. Józefa Ignacego Kraszewskiego 36/128, 30-110 Kraków, Kraków district, MAŁOPOLSKIE voivodeship), registered at the DISTRICT COURT FOR KRAKÓW Śródmieście in KRAKÓW , 11th COMMERCIAL DEPARTMENT OF THE NATIONAL COURT REGISTER under number 0000974857, with NIP: 6772478466, REGON number: 522174138 (hereinafter: " Administrator ").

Contact the Administrator

In all matters related to the processing of personal data, you can contact the Administrator via:

e-mail - at: info@navin.pl;
traditional mail - at the following address: NAVIN PL SP.zOO ul. Stanisława Lema 17F/101, 31-571 Kraków;
by phone - at: +48 576-192-914.

Personal data protection measures

The administrator applies modern organizational and technical security measures to ensure the best possible protection of your personal data and guarantees that it is processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in connection with with the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: " GDPR "), the Act of May 10, 2018 on the protection of personal data and other provisions on data protection personal data.

Information about processed personal data

Using the Store requires the processing of your personal data. Below you will find detailed information about the purposes and legal basis of processing, as well as the processing period and the obligation or voluntary nature of providing it.

Purpose of processing

Processed personal data

Legal basis

Conclusion and performance of the Agreement for the provision of the Account Service

first name and last name
e-mail address
Phone number

art. 6 section 1 letter b GDPR

(processing is necessary to perform the Agreement for the provision of the Account Service concluded with the data subject or to take steps to conclude it)

Providing the above personal data is a condition for concluding and performing the contract for the provision of the Account Service (providing them is voluntary, but the consequence of not providing them will be the inability to conclude and perform the above-mentioned contract, including the creation of an Account). The administrator will process the above. personal data until the limitation period for claims arising from the Agreement for the provision of the Account Service expires.

Purpose of processing

Processed personal data

Legal basis

Conclusion and execution of the Sales Agreement

first name and last name
e-mail address
Phone number
address of residence/business (street, house number, apartment number, city, postal code, country)
delivery address (if different from the address of residence/business)
optionally - company and NIP (if the Buyer is an Entrepreneur or an Entrepreneur with Consumer rights).

art. 6 section 1 letter b GDPR

(processing is necessary to perform the Sales Agreement concluded with the data subject or to take steps to conclude it)

Providing the above personal data is a condition for concluding and performing the Sales Agreement (providing them is voluntary, but failure to provide them will result in the inability to conclude and perform the Sales Agreement).

The administrator will process the above. personal data until the limitation period for claims arising from the Sales Agreement expires.

Purpose of processing

Processed personal data

Legal basis

Conclusion and performance of the Newsletter Delivery Agreement

e-mail address

art. 6 section 1 letter b GDPR

(processing is necessary to perform the Newsletter Delivery Agreement concluded with the data subject or to take steps to conclude it)

and art. 6 section 1 letter f GDPR

(processing is necessary to implement the legitimate interest of the Administrator, in this case, informing about new products and promotions available in the Store)

Providing the above personal data is voluntary, but necessary to receive the Newsletter (the consequence of not providing them will be the inability to receive the Newsletter).

The administrator will process the above. personal data until the objection is effectively raised or the purpose of processing is achieved or until the limitation period for claims arising from the Newsletter Delivery Agreement (depending on which of the above-mentioned events occurs first).

Purpose of processing

Processed personal data

Legal basis

Conducting complaint proceedings

first name and last name
e-mail address

art. 6 section 1 letter c GDPR

(processing is necessary to fulfill the legal obligation imposed on the Administrator, in this case the obligations:

responding to a complaint – art. 7a of the Consumer Rights Act;
implementation of the Customer's rights arising from the provisions on the Administrator's liability in the event of non-compliance of the Physical Good with the Sales Agreement or the Subject of the digital service with the Agreement relating to it)

Providing the above personal data is a condition for receiving a response to a complaint or exercising the Customer's rights arising from the provisions on the Administrator's liability in the event of non-compliance of the Physical Good with the Sales Agreement or the Subject of the digital service with the Agreement relating to it (providing them is voluntary, but the consequence of not providing them will be the inability to receive a response to the complaint and implementation of the above-mentioned rights).

The administrator will process the above. personal data for the duration of the complaint procedure, and in the event of the above-mentioned implementation. the Customer's rights - until they expire.

Purpose of processing

Processed personal data

Legal basis

Conducting verification proceedings and considering appeals against decisions on dealing with unacceptable content

name and surname/name,
contact details, including e-mail address

art. 6 section 1 letter c GDPR

(processing is necessary to fulfill the legal obligation imposed on the Administrator, in this case the obligations:

providing a mechanism for reporting unacceptable content (Article 16 of Regulation 2022/2065 on the single market for digital services and amending Directive 2000/31/EC (Digital Services Act)(hereinafter: " DSA "),
handling complaints (Article 20 DSA).

Providing the above personal data is a condition for receiving a response to the notification or exercising the User's rights arising from the provisions of the DSA (providing them is voluntary, but the consequence of not providing them will be the inability to receive a response to the notification and to exercise the above-mentioned rights).

The administrator will process the above. personal data for the duration of the complaint procedure, and in the event of the above-mentioned implementation. User's rights - until they expire.

Purpose of processing

Processed personal data

Legal basis

Sending email notifications

e-mail address

art. 6 section 1 letter f GDPR

(processing is necessary to implement the legitimate interest of the Administrator, in this case informing Customers about activities undertaken related to the performance of Agreements concluded with Customers)

Providing the above personal data, voluntary, but necessary in order to receive information on activities related to the performance of Agreements concluded with Customers (the consequence of not providing them will be the inability to receive the above-mentioned information).

The administrator will process the above. personal data until the objection is effectively raised or the purpose of processing is achieved (depending on which of the above-mentioned events occurs first).

Purpose of processing

Processed personal data

Legal basis

Handling inquiries submitted by customers

name
e-mail address
other data included in the message to the Administrator

art. 6 section 1 letter f GDPR

(processing is necessary to pursue the legitimate interest of the Administrator, in this case to answer the received inquiry)

Providing the above personal data is voluntary, but necessary in order to receive an answer to the inquiry (the consequence of not providing it will be the inability to receive an answer).

Purpose of processing

Processed personal data

Legal basis

Sharing Opinions about Goods

name
optionally – other data included in the Opinion

art. 6 section 1 letter f GDPR

(processing is necessary to pursue the legitimate interest of the Administrator, in this case making the Opinion available for information and promotional purposes)

Providing the above personal data is voluntary, but necessary in order to add an Opinion (the consequence of not providing them will be the inability to add an Opinion).

Purpose of processing

Processed personal data

Legal basis

Informing Customers about the availability of previously unavailable Goods

e-mail address

art. 6 section 1 letter f GDPR

(processing is necessary to implement the legitimate interest of the Administrator, in this case informing Customers about the availability of previously unavailable Goods)

Providing the above personal data is voluntary, but necessary in order to receive notification about the availability of previously unavailable Goods (the consequence of not providing them will be the inability to receive the above-mentioned notification).

Purpose of processing

Processed personal data

Legal basis

Fulfilling tax obligations (including issuing a VAT invoice, storing accounting documentation)

name and surname/company
residential/registered address
Tax Identification Number

art. 6 section 1 letter c GDPR

(processing is necessary to fulfill the legal obligation imposed on the Administrator, in this case obligations arising from tax law)

Providing the above personal data is voluntary, but necessary in order for the Administrator to meet his tax obligations (the consequence of not providing them will be the Administrator's inability to meet the above-mentioned obligations).

The administrator will process the above. personal data for a period of 5 years from the end of the year in which the tax payment deadline for the previous year expired.

Purpose of processing

Processed personal data

Legal basis

Fulfillment of obligations related to the protection of personal data

first name and last name
contact details provided by you (e-mail address; correspondence address; telephone number)

art. 6 section 1 letter c GDPR

(processing is necessary to fulfill the legal obligation imposed on the Administrator, in this case the obligations arising from the provisions on the protection of personal data)

Providing the above personal data is voluntary, but necessary in order for the Administrator to properly perform the obligations arising from the provisions on the protection of personal data, including: exercise the rights granted to you by the GDPR (the consequence of failure to provide the above-mentioned data will be the inability to properly exercise the above-mentioned rights).

The administrator will process the above. personal data until the limitation periods for claims for violation of personal data protection provisions expire.

Purpose of processing

Processed personal data

Legal basis

Establishing, pursuing or defending against claims

name and surname/company
e-mail address
residential/registered address
PESEL number
Tax Identification Number

art. 6 section 1 letter f GDPR

(processing is necessary to implement the legitimate interest of the Administrator, in this case determining, pursuing or defending against claims that may arise in connection with the performance of Agreements concluded with the Administrator)

Providing the above personal data is voluntary, but necessary in order to establish, pursue or defend against claims that may arise in connection with the performance of Agreements concluded with the Administrator (the consequence of failure to provide the above-mentioned data will be the Administrator's inability to take the above-mentioned actions)

The administrator will process the above. personal data until the expiry of the limitation periods for claims that may arise in connection with the performance of Agreements concluded with the Administrator.

Purpose of processing

Processed personal data

Legal basis

Analysis of your activity in the Store

date and time of visit
device IP number
type of device operating system
approximate location
type of web browser
time spent in the Store
viewed Goods
visited subpages and other activities undertaken within the Store

art. 6 section 1 letter f GDPR

(processing is necessary to implement the legitimate interest of the Administrator, in this case obtaining information about your activity in the Store)

Providing the above personal data is voluntary, but necessary in order for the Administrator to obtain information about your activity in the Store (the consequence of not providing them will be the Administrator's inability to obtain the above-mentioned information).

The administrator will process the above. personal data until an effective objection is raised or the purpose of processing is achieved.

Purpose of processing

Processed personal data

Legal basis

Administration of the Store

IP address
server date and time
information about your web browser
information about the operating system

The above data is saved automatically in the so-called server logs each time you use the Store (administrating it without the use of server logs and automatic saving would not be possible).

art. 6 section 1 letter f GDPR

(processing is necessary to implement the legitimate interest of the Administrator, in this case ensuring the proper operation of the Store)

Providing the above personal data is voluntary, but necessary to ensure the proper operation of the Store (the consequence of not providing them will be the inability to ensure proper operation of the Store).

The administrator will process the above. personal data until an effective objection is raised or the purpose of processing is achieved.

Profiling

In order to create your profile for marketing purposes and direct marketing to you tailored to your preferences, the Administrator will process your personal data in an automated manner, including profiling - however, this will not cause any legal or similar effects towards you. significantly influence your situation.

The scope of profiled personal data corresponds to the scope indicated above in relation to the analysis of your activity in the Store and the data you save in the Account.

The legal basis for the processing of personal data for the above purpose is Art. 6 section 1 letter f GDPR, according to which the Administrator may process personal data in order to pursue its legitimate interest, in this case conducting marketing activities tailored to the recipients' preferences. Providing the above personal data is voluntary, but necessary to implement the above-mentioned. purpose (the consequence of not providing them will be the Administrator's inability to conduct marketing activities tailored to the recipients' preferences).

The administrator will process personal data for the purpose of profiling until an effective objection is raised or the purpose of processing is achieved.

Recipients of personal data

The recipients of personal data will be the following external entities cooperating with the Administrator:

hosting company;
logistics operator and courier companies;
online payment system providers;
newsletter service provider;
companies providing tools for analyzing activity in the Store and directing direct marketing to people using it (including Google Analytics);
company providing accounting services;
company providing sales services.

In addition, personal data may also be transferred to public or private entities if such an obligation results from generally applicable provisions of law, a final court judgment or a valid administrative decision.

Transferring personal data to a third country

In connection with the Administrator's use of services provided by Google LLC, your personal data may be transferred to the following third countries: Great Britain, Canada, USA, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia and Australia. The basis for transferring data to the above-mentioned third countries are:

in the case of Great Britain, Canada, Israel, Japan and South Korea - decisions of the European Commission confirming the adequate level of personal data protection in each of the above-mentioned third countries;
for the USA - Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, declaring an adequate level of protection of personal data ensured by the EU-US data protection framework;
for Chile, Brazil, Saudi Arabia, Qatar, India, China, Singapore, Taiwan (Republic of China), Indonesia and Australia, contractual clauses ensuring an adequate level of protection, in line with the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

You can obtain from the Administrator a copy of the data transferred to a third country.

Right

In connection with the processing of personal data, you have the following rights:

the right to information about what personal data concerning you are processed by the Administrator and to receive a copy of this data (the so-called right of access). Issuing the first copy of the data is free of charge, for subsequent copies the Administrator may charge a fee;
if the processed data becomes outdated or incomplete (or otherwise incorrect), you have the right to request its rectification;
in certain situations, you can ask the Administrator to delete your personal data, e.g. when:
1. the data will no longer be needed by the Administrator for the purposes he informed about;
2. you have effectively withdrawn your consent to data processing - unless the Administrator has the right to process data on another legal basis;
3. the processing is unlawful;
4. the need to delete data results from the legal obligation imposed on the Administrator;
if personal data are processed by the Administrator on the basis of consent to processing or in order to perform the Agreement concluded with him, you have the right to transfer your data to another administrator;
if personal data are processed by the Administrator on the basis of your consent to processing, you have the right to withdraw this consent at any time (withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal);
if you find that the personal data being processed is incorrect, their processing is unlawful, or the Administrator no longer needs specific data, you may request that the Administrator not make any changes to the data for a specific period of time (e.g. to check the correctness of the data or pursue claims). operations, but only stored them;
you have the right to object to the processing of personal data whose processing is based on the legitimate interest of the Administrator. In the event of an effective objection, the Administrator will stop processing personal data in the above-mentioned. purpose;
you have the right to lodge a complaint with the President of the Personal Data Protection Office if you believe that the processing of personal data violates the provisions of the GDPR.

Cookies

The Administrator informs that the Store uses "cookies" files installed on your end device. These are small text files that can be read by the Administrator's system, as well as by systems belonging to other entities whose services the Administrator uses (e.g. Facebook, Google).
The administrator uses cookies for the following purposes:
1. ensuring the proper operation of the Store - thanks to cookies, it is possible to operate the Store efficiently, use its functions and conveniently move between individual subpages;
2. increasing the comfort of browsing the Store - thanks to cookies, it is possible to detect errors on some subpages and constantly improve them;
3. creating statistics - cookies are used to analyze how users use the Store. This makes it possible to constantly improve the Store and adapt its operation to users' preferences;
4. conducting marketing activities - thanks to cookies, the Administrator can direct advertising to users tailored to their preferences.
The administrator can place both permanent and temporary (session) files on your device. Session files are usually deleted when you close the browser, but closing the browser does not delete persistent files.
Information about cookies used by the Administrator is displayed in the panel located at the bottom of the Store's website. Depending on your decision, you can enable or disable cookies of individual categories (except essential cookies) and change these settings at any time.
Data collected using cookies does not allow the Administrator to identify you.
The administrator uses the following cookies or tools that use them:

TOOL	SUPPLIER	FUNCTIONS AND SCOPE OF DOWNLOADED DATA	OPERATION PERIOD
Necessary cookies	Administrator	The operation of these files is necessary for the proper functioning of the Store's website, so you cannot disable them. Thanks to these files (which collect, among others, the IP number of your device), it is possible, among others, to: informing you about cookies operating on the Store's website	Most necessary cookies are session cookies, but some remain on your end device for a period of 3 months or until they are deleted;
Google Analytics	Google	This tool enables the collection of statistical data on how the Store is used by Customers, including: about the number of visits, duration of visits, search engine used, location. The collected data helps improve the Store and make it more customer-friendly.	up to 2 years or until they are removed (depending on which of the following events occurs first)
Facebook Instagram	Facebook	This tool allows you to determine that you have visited the Store, direct ads displayed on Facebook and Instagram to you, and measure their effectiveness.	up to 3 months or until they are removed (depending on which of the following events occurs first)

7. Using most commonly used browsers, you can check whether cookies have been installed on your end device, as well as delete installed cookies and block their installation in the future by the Store. However, disabling or limiting the use of cookies may cause quite serious difficulties in using the Store, e.g. the need to log in on each subpage, a longer loading time of the Store's website, and limitations in the use of some functionalities.

Final Provisions

To the extent not regulated by the Policy, generally applicable provisions on the protection of personal data shall apply.

The policy is valid from August 1, 2024.