Privacy policy

Privacy Policy for the website: https://babyandtravel.com

 

Thank you for your interest in our services.

We make every effort to protect the personal data we collect in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter referred to as the “GDPR”) (OJ EU L 119, 04.05.2016), and with national legislation.

We provide this Privacy Policy so that everyone with whom we interact knows who controls their personal data, the extent to which, purposes for which and legal bases on which we process it, who we share it with, and what rights they have in relation to its processing.

PERSONAL DATA CONTROLLER

The Personal Data Controller is BABY&TRAVEL sp. z o. o., with its registered office in Wrocław (54-530), Poland, at ul. Piołunowa 20.

You can contact the Controller:

For matters concerning the processing of personal data, please email: [email protected].

  1. DEFINITIONS

1.1. Personal data – information relating to an identified or identifiable natural person, including a device’s IP address, location data, an online identifier and information collected through cookies or other similar technology.

1.2. Policy – this Privacy Policy.

1.3 GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

1.4 Website – the website operated at: https://babyandtravel.com.

1.5 User – any natural person visiting the Website or using one or more of the services or features described in the Policy.

 

  1. DATA PROCESSING IN CONNECTION WITH USE OF THE WEBSITE

In connection with the User’s use of the Website, the Controller collects data to the extent necessary to provide the services offered, as well as information about the User’s activity on the Website.

  1. PURPOSES AND LEGAL BASES FOR PROCESSING DATA ON THE WEBSITE

Each time a page is requested, that is, when our website is visited, the server automatically records only server logs, such as the name of the requested file, the IP address, the date and time of the request and the amount of data transferred, and also records the page request.

The personal data of everyone using the Website (including IP addresses or other identifiers and information collected through cookies or other similar technologies) is processed by the Controller to provide electronic services consisting of making the content collected on the Website available to Users – in which case the legal basis for processing is its necessity for the performance of a contract (Article 6(1)(b) GDPR) – and for technical and administrative purposes, to ensure the security and management of the IT system – in which case the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) GDPR).

ONLINE SHOP AND WHOLESALE PLATFORM

The Controller enables purchases of the Company’s products through an online shop and a wholesale platform. Placing an order requires the provision of Personal Data comprising: first name, surname, shipping address, email address and telephone number. If an invoice is requested, a tax identification number (NIP) must also be provided. Personal Data will be processed for the purposes of:

  • maintaining the Customer’s account in the baby&travel.pl online shop/wholesale platform, fulfilling orders and communicating with the Customer about after-sales matters related to order fulfilment, which constitutes performance of the contract concluded with the User (Article 6(1)(b) GDPR, Article 18 of the Polish Act of 18 July 2002 on the Provision of Services by Electronic Means),
  • fulfilling legal obligations to which the Controller is subject (Article 6(1)(c) GDPR), including accounting and compliance with tax law obligations related to transactions,
  • handling complaints and claims and defending against claims, which constitutes the Controller’s legitimate interest (Article 6(1)(f) GDPR),
  • enabling publication of product reviews and ratings, which constitutes the Controller’s legitimate interest (Article 6(1)(f) GDPR) in striving for the highest possible quality of the products offered,
  • verifying reported posts containing illegal content and taking appropriate action, which constitutes a legal obligation to which the Controller is subject (Article 6(1)(c) GDPR),
  • conducting Customer satisfaction research by sending relevant surveys, which constitutes the Controller’s legitimate interest (Article 6(1)(f) GDPR) in striving to provide high-quality services.

Providing personal data is voluntary; however, refusal to provide it may prevent the purposes listed above from being fulfilled.

EMAIL AND CONTACT FORM

The Controller can be contacted by email and through the contact form.

Using these forms of contact requires the provision of Personal Data necessary to correspond with the User and respond to the enquiry submitted. The User may also provide other data to help with handling the enquiry. Providing data is voluntary, and refusal to provide it will make correspondence impossible. Personal Data provided in an email or contact form will be processed for the purposes of correspondence, providing information and answering questions, which constitutes the Controller’s legitimate interest (Article 6(1)(f) GDPR).

COMPETITIONS, WEBINARS AND MARKETING ACTIVITIES

The Controller enables Website Users to take part in competitions and webinars and to receive marketing information.

Participation in these activities may require the provision of Personal Data such as: first name and surname, email address, telephone number, social media login or nickname, correspondence address, purchase receipt details, prize delivery details, and the name and address of the relevant tax office (where a tax settlement is required). The legal bases for processing this data are:

  1. consent to data processing (Article 6(1)(a) GDPR) for the receipt and assessment of competition entries, participation in webinars and receipt of marketing content,
  2. a legal obligation to which the Controller is subject (Article 6(1)(c) GDPR), arising from tax and accounting legislation,
  3. the Controller’s legitimate interest (Article 6(1)(f) GDPR) in fulfilling its obligation to award prizes to winners, which requires contacting winners and dispatching prizes.

Providing personal data is voluntary. However, refusal to provide it may prevent participation in the Competition or receipt of marketing content.

NEWSLETTER

The Controller sends a Newsletter containing marketing information about the shop’s product range, prices, promotions and invitations to webinars. Sending the Newsletter requires you to provide Personal Data in the form of an email address. Personal data is processed on the basis of the User’s consent (Article 6(1)(a) GDPR). Providing personal data is voluntary. However, refusal to provide it will prevent receipt of information about the Controller’s activities by email.

 

SOCIAL MEDIA PLATFORMS

The Controller maintains a profile (a “fan page”) on Facebook, Instagram, LinkedIn and YouTube. Personal data processed through these platforms is controlled by a third party. This third party’s processing of your personal data is governed by the law applicable to the platform operator and by its internal policies (such as privacy policies). This Privacy Policy does not govern that third party’s processing of personal data.

However, the Controller may also act as an independent controller of personal data processed in the course of managing the “Baby&Travel” fan pages, processing personal data on the terms set out below. The Controller processes personal data on its Facebook and Instagram fan pages for the purposes of:

  • carrying out marketing activities consisting of providing information about Baby&Travel and its services through the fan pages, including publishing posts, which constitutes a legitimate interest pursued by the Controller (Article 6(1)(f) GDPR);
  • responding to private messages sent through the platforms’ messaging features – in this case, the legal basis for processing is the Controller’s legitimate interest in conducting correspondence (Article 6(1)(f) GDPR);
  • conducting discussions under posts published on the fan pages, allowing participation through accounts on the platforms, which constitutes a legitimate interest pursued by the Controller (Article 6(1)(f) GDPR);
  • obtaining statistical data – the Controller may receive statistical data about the fan pages from platform operators, generated by those operators through monitoring your activity on the fan pages; in this situation, the legitimate interest pursued by the Controller is the analysis of statistical data about the fan pages (Article 6(1)(f) GDPR).

Providing personal data is voluntary. When you communicate with the Controller in any way through these platforms, the Controller will automatically receive the details identifying your account (first name, surname or nickname, as well as your photograph and other publicly available information). You may stop following the Controller’s fan pages and delete comments you have posted at any time.

  1. COOKIES

Cookies are small text files installed on the device of a User browsing the Website. Cookies collect information that makes the website easier to use – for example, by remembering the User’s visits to the Website and the actions they take.

The Controller uses essential cookies needed to ensure the website operates safely and correctly. The website cannot function without them.

The Controller may also use cookies to compile anonymous statistics showing how the Website is used and for marketing purposes, namely to study visitors’ behaviour through anonymous analysis of their activities (such as repeated visits to particular pages, keywords, etc.), in order to create a profile and provide advertising tailored to their anticipated interests, including when they visit other websites. These activities take place on the basis of the User’s consent (Article 6(1)(a) GDPR).

 

TECHNOLOGIES USED

GOOGLE ANALYTICS

The Website uses Google Analytics, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The Controller carries out these activities on the basis of its legitimate interest (Article 6(1)(f) GDPR) in compiling and analysing statistics to optimise websites.

Information about the User’s use of the Website is collected automatically by Google Analytics and stored on a Google server in the United States.

The User’s IP address is shortened before being transmitted further. In certain situations, the User’s full IP address is sent to a Google server in the United States and shortened there. As a rule, the anonymised IP address sent by the User’s browser as part of Google Analytics is not combined with other Google data.

Google LLC, based in the USA and using technical infrastructure located in the USA, provides an adequate level of protection for the personal data processed, as accepted by the European Commission.

The User can prevent Google from recording data collected by cookies about the User’s use of the Website, and from processing this data, by installing the browser add-on available at: https://tools.google.com/dlpage/gaoptout.

Details of data processing within Google Analytics are available at: https://support.google.com/analytics/answer/6004245.

 

  1. PERSONAL DATA RETENTION PERIOD

The period for which the Controller processes data depends on the type of service provided and the purpose of processing. As a rule, data is processed for the duration of the service or contract, or until an effective objection to processing is made where the legal basis for processing is the Controller’s legitimate interest. The processing period may be extended where processing is necessary to establish, pursue or defend claims, and thereafter only where and to the extent required by law. Once the processing period has ended, the data is irreversibly deleted or anonymised.

Personal data processed on the basis of the User’s consent will be retained until that consent is withdrawn.

Where Data must be processed for tax and accounting purposes, it will be retained for the period required by law.

  1. USER RIGHTS

Within the limits and on the terms set out in the GDPR, Website Users have the right to:

  • access their personal data, including obtaining a copy,
  • request rectification of personal data,
  • request erasure of personal data,
  • request restriction of data processing,
  • data portability,
  • object to the processing of personal data where the data is processed on the basis of the Controller’s legitimate interest.
  1. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

If you believe that our personal data processing activities have infringed your rights, you may lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (ul. Moniuszki 1A, 00-014 Warsaw, Poland, https://uodo.gov.pl).

  1. DATA RECIPIENTS

For the purposes set out in this Policy, the Controller may disclose Personal Data to the following categories of third parties:

  • partners providing IT tools for internal management and data sharing, to whom the Controller entrusts processing under data processing agreements. Recipients of personal data may include, in particular, internet service providers, including email providers,
  • postal and courier service providers,
  • payment service providers,
  • law firms,
  • accounting service providers,
  • analytics service providers,
  • entities and authorities entitled to request access to Personal Data under generally applicable law (such as tax authorities).
  1. TRANSFERS OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

As a rule, your personal data will not be transferred to countries outside the European Economic Area, with the exception of personal data posted on the Company’s fan pages on Facebook, Instagram, LinkedIn and YouTube. The providers of these platforms ensure an adequate level of protection for the personal data processed, as accepted by the European Commission.

The Controller always informs you of any intention to transfer Personal Data outside the EEA at the time it is collected.

If, during processing, your personal data is transferred to recipients in third countries (outside the EEA), such transfers may take place on the basis of:

  • an adequacy decision (Article 45 GDPR), including for the United Kingdom;
  • appropriate safeguards, including standard data protection clauses, an approved code of conduct or an approved certification mechanism (Article 46 GDPR);
  • binding corporate rules (Article 47 GDPR);
  • applicable derogations for specific situations (Article 49 GDPR).
  1. REQUIREMENT TO PROVIDE DATA

Providing personal data to the Controller is voluntary, but necessary to fulfil the purposes specified in section 3.

  1. PERSONAL DATA SECURITY

The Controller ensures that Personal Data is processed securely – above all, only authorised persons have access, and only to the extent necessary for their duties. The Controller ensures that all operations on Personal Data are recorded and performed only by authorised employees and associates. The Controller takes all necessary steps to ensure that its subcontractors and other cooperating entities also guarantee the application of appropriate security measures whenever they process Personal Data on its behalf.

  1. CHANGES TO THE PRIVACY POLICY

This Policy is reviewed regularly and updated as necessary.