Privacy Policy

1. GENERAL PROVISIONS
The privacy policy of the Online Store www.flowshop.pl is for informational purposes only and does not constitute a source of obligations for the Store’s Customers.
The controller of personal data collected via the Online Store is BOARD SPORT POLSKA sp z o.o., registered in the National Court Register (KRS) under number 0000711415, with its registered office in Warsaw and business address: Al. Prymasa Tysiąclecia 46 lok 5, 01-242 Warsaw, email address: boardsport@boardsport.pl, phone number: +48 22 8207296 – hereinafter referred to as the “Controller” and at the same time the Online Store Service Provider and Seller.
In connection with the application as of 25 May 2018 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”), we inform you that as of 25 May 2018 you will be entitled to the rights set out below in connection with the processing of your personal data.
At the same time, pursuant to Article 13 of the GDPR, we inform you that as of 25 May 2018 the following information and rules regarding the processing of your personal data will apply.
The Controller exercises particular care to protect the interests of data subjects, and in particular ensures that the data collected by it are processed lawfully; collected for specified, lawful purposes and not further processed in a manner incompatible with those purposes; factually correct and adequate in relation to the purposes for which they are processed, and stored in a form which permits identification of the data subjects for no longer than is necessary for the purposes of processing.
Your personal data will be processed by the owner of the online store – the Controller, Board Sport company (also hereinafter referred to as the company), which can be contacted by email by sending a message to boardsport@boardsport.pl, by calling +48 22 8207296, or by visiting the Company’s registered office at: Al. Prymasa Tysiąclecia 46 lok 5, 01-242 Warsaw

2. PURPOSE AND SCOPE OF DATA COLLECTION AND DATA RECIPIENTS
2.1 Purposes of data collection:
2.1.1 for the purpose of registration and creating an account in the online store. Persons who register in the Store are asked to provide the data necessary to create and operate the account. In order to facilitate service, the User may provide additional data, thereby consenting to its processing. Such data may be deleted at any time. Providing data marked as mandatory is required to create and operate the account, and failure to provide it will result in the inability to create an account. Providing the remaining data is voluntary.
2.1.2 for the purpose of providing electronic services and concluding sales agreements – the legal basis for the processing of personal data is Article 6(1)(b) of the GDPR. Placing an order (purchase of goods or services) by the User involves the processing of their personal data. Providing data marked as mandatory is required to accept and process the order, and failure to provide it will result in the order not being fulfilled.
2.1.3 for the purpose of sending marketing content (newsletters) to you by the Company in the manner to which you have consented – the legal basis for the processing of personal data is the legitimate interest of the company (Article 6(1)(f) of the GDPR); the legitimate interest of the company consists in sending marketing content to you during the period of providing electronic services to you by email and additionally in the manner to which you have consented,
2.1.4 for the purpose of fulfilling legal obligations incumbent on the company under generally applicable laws, including tax and accounting regulations – the legal basis for the processing of personal data is Article 6(1)(c) of the GDPR,
2.1.5 for analytical and statistical purposes – the legal basis for the processing of personal data is the legitimate interest of the company (Article 6(1)(f) of the GDPR); the legitimate interest of the company is to analyze the results of its business activities,
2.1.6 for the purpose of pursuing the company’s legitimate interest consisting in the possible establishment or assertion of claims or defense against claims – the legal basis for the processing of personal data is the legitimate interest of the company – Article 6(1)(f) of the GDPR.
2.1.7 the controller provides the possibility of contacting it using electronic contact forms. Using the form requires providing personal data necessary to contact the User and respond to the inquiry. The User may also provide other data in order to facilitate contact or handling of the inquiry. Providing data marked as mandatory is required in order to accept and handle the inquiry, and failure to provide it will result in the inability to handle it. Providing the remaining data is voluntary. Personal data are processed for the purpose of identifying the sender and handling their inquiry submitted via the provided form – the legal basis for processing is the necessity of processing for the performance of a service contract (Article 6(1)(b) of the GDPR)
2.1.8 the controller provides assistance in selecting the appropriate equipment using an electronic equipment selection form, in which data are collected that will allow us to individually select the appropriate equipment for you. Providing data marked as mandatory is required in order to accept and handle the inquiry, and failure to provide it will result in the inability to handle it. Providing the remaining data is voluntary. Personal data are processed for the purpose of identifying the sender and handling their inquiry submitted via the provided form – the legal basis for processing is the necessity of processing for the performance of a service contract (Article 6(1)(b) of the GDPR)
2.1.9 the controller processes the personal data of Users visiting the Controller’s profiles maintained on social media (Facebook, YouTube, Instagram, Twitter, Google +, Pinterest). These data are processed solely in connection with maintaining the profile, including for the purpose of informing Users about the Controller’s activities and promoting various events, services and products, as well as for communicating with users via functionalities available in social media. The legal basis for the Controller’s processing of personal data for this purpose is its legitimate interest (Article 6(1)(f) of the GDPR) consisting in promoting its own brand and building and maintaining a community associated with the brand.
2.2 Recipients of your personal data may include:
2.2.1 providers of IT systems and IT services,
2.2.2 entities providing accounting services, service quality research, debt collection, legal, analytical, and marketing services to the company,
2.2.3 carriers / freight forwarders / courier brokers,
2.2.4 entities handling electronic payments or card payments, credit institutions
2.2.5 authorities entitled to receive your personal data under the law.
2.2.6. The Company will not transfer your personal data to third countries.
2.3. Your personal data will be processed: (1) in the case of personal data processed for the purpose of concluding and performing sales agreements – for the time necessary to perform all obligations arising from the sales agreements, (2) in the case of personal data processed for the purpose of providing services to you by electronically – for the duration of providing services to you by electronic means, (3) in the case of personal data processed for the purpose of sending marketing content to you by the company – until you object to the processing of personal data in this respect.
After this period, personal data will be processed only to the extent and for the period required by law, including accounting regulations.
2.4. Your personal data will be subject to profiling:
2.4.1 The Controller may use profiling in the Online Store for the purposes of direct marketing, but decisions made on this basis by the Controller do not concern the conclusion or refusal to conclude a Sales Agreement, or the possibility of using Electronic Services in the Online Store. The effect of using profiling in the Online Store may be, for example, granting a discount to a given person, sending them a discount code, reminding them about unfinished purchases, sending a proposal for a Product that may match the interests or preferences of that person, or offering better terms compared to the standard offer of the Online Store. Despite profiling, the person concerned freely decides whether they want to use the discount or better terms received in this way and make a purchase in the Online Store.
2.4.2 The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.
2.5. Any consent given may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal. For evidentiary purposes, the company requests that consent be withdrawn in writing to the address: Board Sport Polska Sp. z o.o. Al.Prymasa Tysiąclecia 46 lok 5, 01-242 Warszawa
or electronically (email message to: boaardsport@boardsport.pl )
2.6. You have the right to access your personal data, rectify it, erase it or restrict its processing, and to lodge a complaint with the supervisory authority in the field of personal data protection.
2.7. You have the right to data portability, including the right to receive the data and transmit it to another controller or to request, where technically possible, that the data be transmitted directly to another controller.
2.8. Providing personal data is voluntary, subject to two exceptions:
2.8.1 concluding agreements with the Controller – failure to provide, in the cases and to the extent indicated on the Online Store website and in the Online Store Terms and Conditions, the personal data necessary to conclude and perform the Sales Agreement or the agreement for the provision of Electronic Services with the Controller results in the inability to conclude such agreement. Providing personal data is in such a case a contractual requirement and if the data subject wishes to conclude a given agreement with the Controller, they are obliged to provide the required data. The scope of data required to conclude the agreement is always indicated in advance on the Online Store website and in the Online Store Terms and Conditions;
2.8.2 statutory obligations of the Controller – providing personal data is a statutory requirement arising from generally applicable legal provisions imposing on the Controller the obligation to process personal data (e.g. processing data for the purpose of keeping tax or accounting records) and failure to provide them will prevent the Controller from fulfilling these obligations.

3. COOKIES AND OPERATIONAL DATA
Cookies are small text information in the form of text files, sent by the server and stored on the side of the person visiting the Online Store website (e.g. on the hard drive of a computer, laptop, or on the memory card of a smartphone – depending on the device used by the visitor to our Online Store). Detailed information about Cookies, as well as their history, can be found, among others, here: http://pl.wikipedia.org/wiki/Ciasteczko.
The Controller may process data contained in Cookies while visitors use the Online Store website for the following purposes:
3.1 identifying Service Recipients as logged in to the Online Store and showing that they are logged in;
3.2 remembering Products added to the cart in order to place an Order;
3.3 remembering data from completed Order Forms, surveys or login data to the Online Store;
3.4 adapting the content of the Online Store website to the individual preferences of the Service Recipient (e.g. regarding colors, font size, page layout) and optimizing the use of the Online Store websites;
3.5 conducting anonymous statistics showing how the Online Store website is used.
By default, most web browsers available on the market accept the storage of Cookies by default. Everyone has the ability to define the conditions for using Cookies through their own web browser settings. This means that it is possible, for example, to partially limit (e.g. temporarily) or completely disable the storage of Cookies – in the latter case, however, this may affect some functionalities of the Online Store (for example, it may be impossible to complete the Order path via the Order Form due to Products not being remembered in the cart during subsequent steps of placing the Order).
Web browser settings regarding Cookies are important from the point of view of consent to the use of Cookies by our Online Store – in accordance with the regulations, such consent may also be expressed through web browser settings. In the absence of such consent, the web browser settings regarding Cookies should be changed accordingly.
The Controller also processes anonymized operational data related to the use of the Online Store (IP address, domain) to generate statistics helpful in administering the Online Store. These data are aggregate and anonymous, i.e. they do not contain features identifying visitors to the Online Store website. These data are not disclosed to third parties.
We would like to draw your attention to the fact that if we place links on our Store website leading to other websites not administered by us, we cannot be responsible either for the content of those websites or for the level of privacy protection implemented by the administrators of those websites. By deciding to go to such websites, the Customer does so at their own risk. We also encourage you to familiarize yourself with the privacy policy implemented by those websites before the Customer provides them with their personal data.

4. COLLECTION, OBTAINING, SCOPE AND PURPOSE OF PERSONAL DATA COLLECTION
1. The Controller informs Users that it entrusts the processing of personal data to the following entities:
a) Edrone Sp. z o.o., ul.1 Lekarska, 31-203 Kraków, NIP: 676-248-20-64, KRS: 0000537197 – for the purpose of using the edrone.me mailing system, used to send the newsletter,
b) Edrone Sp. z o.o., ul. Lekarska 1, 31-203 Kraków, NIP: 676-248-20-64, KRS: 0000537197: – for marketing purposes only for email, sms, social media campaigns launched or indicated by the Controller using the edrone system,
2. The Controller informs that it uses the following technologies to track actions taken by the user/Customer within the Store website:
a) edrone tracking codes – for the purpose of analyzing website statisticsof the Store’s website, as well as for marketing purposes solely for the needs of e-mail, SMS, and social media campaigns launched or indicated by the Administrator via the edrone system.

5. FINAL PROVISIONS
The Administrator applies technical and organizational measures ensuring the protection of processed personal data appropriate to the threats and categories of data covered by protection, and in particular protects data against disclosure to unauthorized persons, removal by an unauthorized person, processing in violation of applicable regulations, as well as alteration, loss, damage, or destruction.
The Administrator appropriately provides the following technical measures preventing unauthorized persons from obtaining and modifying personal data transmitted electronically:
4.1 Protection of the data set against unauthorized access.
4.2 Access to the Account only after entering an individual login and password.