PRIVACY POLICY

§1. PERSONAL DATA CONTROLLER

1. The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”), is Grassland Horse Feeding Spółka z ograniczoną odpowiedzialnością, a Polish limited liability company with its registered office in Gostkowo at ul. Ekologiczna 10a, 87-148 Gostkowo, tax identification number (NIP): 8792736180, statistical identification number (REGON): 520784654, entered in the Register of Entrepreneurs of the National Court Register under KRS number: 0000942090, registration court: District Court in Toruń, 7th Commercial Division of the National Court Register, share capital: PLN 5,000.00.
2. The Controller’s email address is: info@grassland.com.pl.
3. In accordance with Article 32(1) of the GDPR, the Controller complies with personal data protection principles and implements appropriate technical and organisational measures to prevent accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, personal data processed in connection with its business activities.
4. Providing personal data is voluntary but necessary for the Customer to enter into a contract with the Controller.
5. The Controller processes personal data to the extent necessary to perform a contract or provide services to the data subject.

§2. PURPOSES AND LEGAL BASES FOR PROCESSING PERSONAL DATA

The Controller processes personal data for the following purposes:
a) preparing a commercial offer in response to the Customer’s expression of interest, which constitutes the Controller’s legitimate interest (Article 6(1)(f) of the GDPR);
b) concluding and performing sales contracts with Customers, on the basis of the contract concluded (Article 6(1)(b) of the GDPR);
c) providing electronic services through the Online Store, on the basis of the contract concluded (Article 6(1)(b) of the GDPR);
d) handling complaints, on the basis of the Controller’s obligations under applicable law (Article 6(1)(c) of the GDPR);
e) accounting purposes relating to the issuance and receipt of accounting documents, on the basis of tax legislation (Article 6(1)(c) of the GDPR);
f) archiving data for the possible establishment, exercise or defence of legal claims, or to establish facts, which constitutes the Controller’s legitimate interest (Article 6(1)(f) of the GDPR);
g) communicating by telephone or email, in particular in response to enquiries addressed to the Controller, which constitutes the Controller’s legitimate interest (Article 6(1)(f) of the GDPR);
h) sending technical information concerning the operation of the Online Store and the services used by the Customer, which constitutes the Controller’s legitimate interest (Article 6(1)(f) of the GDPR);
i) marketing, on the basis of the Controller’s legitimate interest (Article 6(1)(f) of the GDPR) or previously obtained consent (Article 6(1)(a) of the GDPR).

§3. DATA RECIPIENTS AND TRANSFERS TO THIRD COUNTRIES

1. Recipients of personal data processed by the Controller may include entities cooperating with the Controller where this is necessary to perform the contract concluded with the data subject.
2. Recipients of personal data processed by the Controller may also include subcontractors whose services the Controller uses when processing data, such as accounting firms, law firms and IT service providers, including hosting providers.
3. The Controller may be required to disclose personal data under applicable law, in particular to authorised public authorities or state institutions.
4. As the Controller uses tools to analyse and track website traffic, personal data may be transferred to an entity established outside the European Economic Area, such as Google LLC. As an appropriate safeguard for personal data, the Controller has agreed to standard contractual clauses with these service providers in accordance with Article 46 of the GDPR. Further information is available at: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu_en.

§4. PERSONAL DATA RETENTION PERIOD

1. The Controller retains personal data for the duration of the contract concluded with the data subject and, after its termination, for purposes relating to pursuing claims arising from the contract and fulfilling obligations under applicable law, but for no longer than the limitation period prescribed by the Polish Civil Code.
2. The Controller retains personal data contained in accounting documents for the period prescribed by the Polish Value Added Tax Act and the Polish Accounting Act.
3. The Controller retains personal data processed for marketing purposes for 10 years, but no longer than until consent to processing is withdrawn or an objection to processing is raised.
4. The Controller retains personal data for purposes other than those specified in paragraphs 1–3 for one year, unless consent to processing is withdrawn earlier and processing cannot continue on a legal basis other than the data subject’s consent.

§5. RIGHTS OF THE DATA SUBJECT

1. Every data subject has the following rights:
   a) Right of access – the right to obtain confirmation from the Controller as to whether their personal data is being processed. Where personal data is being processed, the data subject is entitled to access it and obtain information about the purposes of processing, the categories of personal data, the recipients or categories of recipients to whom the data has been or will be disclosed, the data retention period or the criteria used to determine it, and the right to request rectification, erasure or restriction of processing and to object to such processing (Article 15 of the GDPR);
   b) Right to receive a copy of the data – the right to obtain a copy of the personal data undergoing processing. The first copy is provided free of charge. For further copies, the Controller may charge a reasonable fee based on administrative costs (Article 15(3) of the GDPR);
   c) Right to rectification – the right to request the rectification of inaccurate personal data concerning the data subject or the completion of incomplete data (Article 16 of the GDPR);
   d) Right to erasure – the right to request the erasure of personal data where the Controller no longer has a legal basis for processing it or the data is no longer necessary for the purposes of processing (Article 17 of the GDPR);
   e) Right to restriction of processing – the right to request restriction of the processing of personal data (Article 18 of the GDPR) where: the data subject contests the accuracy of the personal data, for a period enabling the Controller to verify its accuracy; the processing is unlawful and the data subject opposes erasure, requesting restriction of its use instead; the Controller no longer needs the data, but the data subject requires it for the establishment, exercise or defence of legal claims; the data subject has objected to processing, pending verification of whether the Controller’s legitimate grounds override the grounds for the data subject’s objection;
   f) Right to data portability – the right to receive personal data concerning the data subject that they have provided to the Controller in a structured, commonly used and machine-readable format, and to request that the data be transmitted to another controller, where processing is based on the data subject’s consent or a contract concluded with them and is carried out by automated means (Article 20 of the GDPR);
   g) Right to object – the right to object, on grounds relating to the data subject’s particular situation, to the processing of their personal data for the Controller’s legitimate purposes, including profiling. In such cases, the Controller assesses whether there are compelling legitimate grounds for processing that override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of legal claims. If the assessment shows that the data subject’s interests override the Controller’s interests, the Controller must stop processing the data for those purposes (Article 21 of the GDPR).
2. To exercise the rights listed above, the data subject should contact the Controller using the contact details provided and specify which right they wish to exercise and to what extent.
3. The data subject has the right to lodge a complaint with the supervisory authority, namely the President of the Polish Personal Data Protection Office in Warsaw.

§6. PROFILING

Personal data obtained by the Controller will not be processed by automated means, including profiling.

§7. GOOGLE ANALYTICS

1. The Controller uses Google Analytics, a web analytics service provided by Google Inc., based in the United States.
2. Google Analytics uses cookies that enable analysis of how users use the website. Information generated by cookies about use of the website is transmitted to and stored on a Google server. On behalf of the Controller, Google will use this information to analyse users’ use of the website, prepare reports on website activity and provide other services relating to website and Internet use to the party commissioning the service.
3. The data will not be used to identify any natural person.
4. Users may prevent cookies from being stored by adjusting their browser settings. However, in that case, they will not be able to use the website’s full functionality. Users may also prevent Google from collecting data generated by cookies relating to their use of the website, including their IP address, and from processing that data by downloading and installing the browser add-on available at: https://tools.google.com/dlpage/gaoptout?hl=pl.
5. Users may object at any time to the collection and processing by Google of data relating to their use of the website by downloading and installing the browser add-on available at: https://tools.google.com/dlpage/gaoptout?hl=en.

§8. COOKIE POLICY

1. The Online Store does not automatically collect any information other than information contained in cookies.
2. Cookies are computer data, in particular text files, stored on the Customer’s device and used when accessing the Online Store’s web pages. Cookies usually contain the name of the website from which they originate, the length of time they are stored on the device and a unique number.
3. The entity placing cookies on the Customer’s device and accessing them is the Seller as defined in the Online Store’s Terms and Conditions.
4. Cookies are used for the following purposes:
   a) adapting the content of the Online Store’s web pages to the Customer’s preferences and optimising website use. In particular, these files enable the Customer’s device to be recognised and the website to be displayed in a way that meets their individual needs;
   b) generating statistics that help understand how Customers use the websites, allowing their structure and content to be improved;
   c) maintaining the Customer’s session so that they can return to the contents of their shopping cart.
5. The Online Store uses the following types of cookies:
   a) session cookies and persistent cookies. Session cookies are temporary files stored on the Customer’s device until the Customer logs out, leaves the website or closes the software, namely the web browser. Persistent cookies remain on the Customer’s device for the period specified in their parameters or until the Customer deletes them;
   b) essential cookies, which enable the use of services available in the Online Store, such as authentication cookies used for services requiring authentication;
   c) security cookies, used, for example, to detect misuse of authentication within the Online Store;
   d) performance cookies, which enable information to be collected about how the Online Store’s web pages are used;
   e) functional cookies, which remember the Customer’s selected settings and personalise the Customer’s interface, for example in relation to their selected language or region, font size and website appearance;
   f) advertising cookies, which enable advertising content to be delivered to Customers in a way that better matches their interests.
6. In many cases, web browsing software allows cookies to be stored on the Customer’s device by default. Customers may change their cookie settings at any time. In particular, browser settings can be changed to block the automatic handling of cookies or to notify the Customer whenever cookies are placed on their device. Detailed information about the options and methods for managing cookies is available in the settings of the software, namely the web browser.
7. The Seller informs Customers that restricting the use of cookies may affect certain features available in the Online Store.