Privacy policy

This Privacy Policy (hereinafter: "Policy") contains information on the processing of your personal data in connection with the use of the online store "FAL-ASH, operating at the internet address https://fal-ash.com/ (hereinafter: "Store").

All capitalized terms that are not otherwise defined in the Policy shall have the meaning given to them in the Terms and Conditions, available at https://fal-ash.com/pages/legal.

Personal data Administrator

The administrator of your personal data is FASH company with limited liability established in Warsaw (registered office address: ul. Widok 22 lok. 22, 00-023 Warszawa, Poland), entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw, XIV Commercial Division of the National Court Register under KRS number: 0000873287 with a VAT number: 9522211692, REGON number: 387722064, with a share capital of 5.000 zlotys (five thousand PLN) paid in full (hereinafter: “Administrator").

Contact with the Administrator

In all matters related to the processing of personal data, you can contact the Administrator using e-mail - at: customercare@fal-ash.com.

Measures to protect personal data

The Administrator uses modern organizational and technical safeguards to ensure the best possible protection of your personal data and guarantees that it processes them in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: "GDPR"), the Act of 10 May 2018 on the protection of personal data and other provisions on the protection of personal data.

Information about the processed personal data

Using the Store requires the processing of your personal data. Below you will find detailed information about the purposes and legal bases of processing, as well as the period of processing and the obligation or voluntariness to provide them.

Purpose of processing (A):

Conclusion and performance of the Agreement for the provision of the Account Service.

Personal data processed:

name and surname
e-mail address

Legal basis:

Article 6(1)(b) of the GDPR

(processing is necessary for the performance of the Account Service Agreement concluded with the data subject or to take steps to conclude it).

Providing the above-mentioned personal data is a condition for the conclusion and performance of the contract for the provision of the Account Service (their provision is voluntary, but the consequence of not providing them will be the inability to conclude and perform the above-mentioned contract, including the creation of an Account).

The Administrator will process the above-mentioned personal data until the claims arising from the Agreement for the provision of the Account Service expire.

Purpose of processing (B):

Conclusion and performance of the Sales Agreement

Personal data processed:

name and surname
e-mail address
telephone number
address of residence/business activity (street, house number, apartment number, city, postal code, country)
delivery address (if different from the address of residence/business)
optionally - company and NIP (if the Buyer is an Entrepreneur or Entrepreneur with consumer rights)

Legal basis:

Article 6(1)(b) of the GDPR

(processing is necessary for the performance of the Sales Agreement concluded with the data subject or to take steps to conclude it).

Providing the above-mentioned personal data is a condition for the conclusion and performance of the Sales Agreement (their provision is voluntary, but the consequence of not providing them will be the inability to conclude and perform the Sales Agreement).

The Administrator will process the above-mentioned personal data until the claims arising from the Sales Agreement expire.

Purpose of processing (C):

Conclusion and performance of the Newsletter Agreement

Personal data processed:

e-mail address

Legal basis:

Article 6(1)(b) of the GDPR

(processing is necessary for the performance of the Newsletter Delivery Agreement concluded with the data subject or to take action to conclude it)

and

Article 6(1)(f) of the GDPR (processing is necessary to implement the legitimate interest of the Administrator, in this case informing about new products and promotions available in the Store).

Providing the above-mentioned personal data is voluntary, but necessary in order to receive the Newsletter (the consequence of not providing them will be the inability to receive the Newsletter).

The Administrator will process the above-mentioned personal data, the time of effective objection or achievement of the purpose of processing or until the claims arising from the Agreement for the delivery of the Newsletter are time-barred (whichever occurs first).

Purpose of processing (D):

Conducting a complaint procedure

Personal data processed:

name and surname
e-mail address

Legal basis:

Article 6(1)(c) of the GDPR (processing is necessary to fulfill a legal obligation incumbent on the Administrator, in this case the obligations of:

responding to a complaint – Article 7a of the Act on consumer rights;
exercise the Customer's rights resulting from the provisions on the Administrator's liability in the event of non-compliance of the physical Goods with the Sales Agreement or the Subject of digital services with the Agreement concerning it)

Providing the above-mentioned personal data is a condition for receiving a response to the complaint or exercising the Customer's rights under the provisions on the Administrator's liability in the event of non-compliance of the physical Goods with the Sales Agreement or the Digital Service Object with the Agreement concerning it (their application is voluntary, but the consequence of not providing them will be the inability to receive a response to the complaint and the implementation of the above-mentioned rights).

The Administrator will process the above-mentioned personal data for the duration of the complaint procedure, and in the case of the implementation of the above-mentioned rights of the Customer – until they expire.

Purpose of processing (E):

Sending email notifications

Personal data processed:

e-mail address

Legal basis:

Article 6(1)(f) of the GDPR (processing is necessary in order to implement the legitimate interest of the Administrator, in this case informing Customers about the actions taken related to the performance of Contracts concluded with Clients)

Providing the above-mentioned personal data voluntary, but necessary to receive information about activities related to the performance of Contracts concluded with Clients (the consequence of not providing them will be the inability to receive the above-mentioned information).

The administrator will process the above-mentioned personal data until the objection is effectively raised or the purpose of processing is achieved (whichever occurs first).

Purpose of processing (F):

Handling inquiries submitted by Customers

Personal data processed:

name
e-mail address
other data contained in the message to the Administrator

Legal basis:

Article 6(1)(f) of the GDPR (processing is necessary to implement the legitimate interest of the Administrator, in this case to respond to the received inquiry)

Providing the above-mentioned personal data is voluntary, but necessary in order to receive an answer to the inquiry (the consequence of not providing them will be the inability to receive an answer).

The administrator will process the above-mentioned personal data until the objection is effectively raised or the purpose of processing is achieved (whichever occurs first).

Purpose of processing (G):

Fulfilling tax obligations (e.g. issuing a VAT invoice, storing accounting documentation)

Personal data processed:

Name and surname/company
address of residence/registered office
TIN

Legal basis:

Article 6(1)(c) of the GDPR (processing is necessary to fulfill the legal obligation incumbent on the Administrator, in this case obligations arising from tax law)

Providing the above-mentioned personal data is voluntary, but necessary for the Administrator to meet its tax obligations (the consequence of not providing them will be the Administrator's inability to meet the above-mentioned obligations).

The administrator will process the above-mentioned personal data for a period of 5 years from the end of the year in which the tax payment deadline for the previous year expired.

Purpose of processing (H):

Fulfillment of obligations related to the protection of personal data

Personal data processed:

Name and surname
contact details provided by you (e-mail address; correspondence address; telephone number)

Legal basis:

Article 6(1)(c) of the GDPR (processing is necessary to fulfill the legal obligation incumbent on the Administrator, in this case the obligations arising from the provisions on the protection of personal data)

Providing the above-mentioned personal data is voluntary, but necessary for the Administrator to properly perform the obligations arising from the provisions on the protection of personal data, m.in. exercise the rights granted to you by the GDPR (the consequence of not providing the above-mentioned data will be the inability to properly implement the above-mentioned rights).

The administrator will process the above-mentioned personal data until the expiry of the limitation periods for claims for violation of the provisions on the protection of personal data.

Purpose of processing (I):

Fulfillment of obligations related to the protection of personal data

Personal data processed:

Name and surname
contact details provided by you (e-mail address; correspondence address; telephone number)

Legal basis:

The administrator will process the above-mentioned personal data until the expiry of the limitation periods for claims for violation of the provisions on the protection of personal data.

Purpose of processing (J):

Establishing, investigating, or defending against claims.

Personal data processed:

Name and surname/company
e-mail address
address of residence/registered office
PESEL number
TIN

Legal basis:

Article 6(1)(f) of the GDPR (processing is necessary to implement the legitimate interest of the Administrator, in this case to establish, investigate or defend against claims that may arise in connection with the performance of Contracts concluded with the Administrator).

Providing the above-mentioned personal data is voluntary, but necessary to establish, investigate or defend against claims that may arise in connection with the performance of Contracts concluded with the Administrator (the consequence of not providing the above-mentioned data will be the inability of the Administrator to take the above-mentioned actions)

The Administrator will process the above-mentioned personal data until the expiry of the limitation periods for claims that may arise in connection with the performance of Contracts concluded with the Administrator.

Purpose of processing (K):

Analysis of your activity in the Store.

Personal data processed:

Date and time of visit
IP number of the device
Device operating system type
approximate location
type of web browser
time spent in the Store
Goods viewed
visited subpages and other activities undertaken as part of the Store

Legal basis:

Article 6(1)(f) of the GDPR (processing is necessary to implement the legitimate interest of the Administrator, in this case obtaining information about your activity in the Store).

Providing the above-mentioned personal data is voluntary, but necessary for the Administrator to obtain information about your activity in the Store (the consequence of not providing them will be the Administrator's inability to obtain the above-mentioned information).

The administrator will process the above-mentioned personal data until the effective objection is raised or the purpose of processing is achieved.

Purpose of proceeding (L):

Store administration.

Personal data processed:

IP address
server date and time
Web browser information
Operating system information

The above data is saved automatically in the so-called server logs, each time you use the Store (administering it without using server logs and automatic saving would not be possible).

Legal basis:

Article 6(1)(f) of the GDPR (processing is necessary to implement the legitimate interest of the Administrator, in this case to ensure the proper operation of the Store).

Providing the above-mentioned personal data is voluntary, but necessary to ensure the proper operation of the Store (the consequence of not providing them will be the inability to ensure the operation of the Store in a proper manner).

The administrator will process the above-mentioned personal data until the effective objection is raised or the purpose of processing is achieved.

Profiling

To create your profile for marketing purposes and direct marketing tailored to your preferences, the Administrator will process your personal data in an automated manner, including profiling them – however, this will not cause any legal effects for you or similarly significantly affect your situation.

The scope of profiled personal data corresponds to the scope indicated above in relation to the analysis of your activity in the Store and the data you save on the Account.

The legal basis for the processing of personal data for the above purpose is art. 6 par. 1 lit. f GDPR, according to which the Administrator may process personal data to implement his legitimate interest, in this case to conduct marketing activities tailored to the preferences of recipients. Providing the above-mentioned personal data is voluntary, but necessary to achieve the above-mentioned purpose (the consequence of not providing them will be the inability of the Administrator to conduct marketing activities tailored to the preferences of recipients).

The administrator will process personal data for the purpose of profiling until an objection is effectively raised or the purpose of processing is achieved.

Recipients of personal data

The recipients of personal data will be the following external entities cooperating with the Administrator:

hosting company;
logistics operator and courier companies;
providers of online payment systems;
newsletter service provider;
a company providing accounting services;
a company providing legal services

In addition, personal data may also be transferred to public or private entities, if such an obligation results from generally applicable law, a final court judgment or a final administrative decision.

Transfer of personal data to a third country

In connection with the Administrator's use of services provided by Google LLC, your personal data may be transferred to the following third countries: Great Britain, Canada, USA, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia and Australia. The basis for the transfer of data to the above-mentioned third countries are:

in the case of the United Kingdom, Canada, Israel and Japan - decisions of the European Commission stating an adequate level of protection of personal data in each of the above-mentioned third countries;
for the USA, Chile, Brazil, Saudi Arabia, Qatar, India, China, South Korea, Singapore, Taiwan (Republic of China), Indonesia and Australia, contractual clauses ensuring an adequate level of protection, in accordance with the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to a Regulation of the European Parliament and of the Council (EU) 2016/679.

You can obtain from the Administrator a copy of the data transferred to a third country.

Your rights

In connection with the processing of personal data, you have the following rights:

the right to information about what personal data concerning you is processed by the Administrator and to receive a copy of this data (the so-called right of access). Issuing the first copy of the data is free, for the next one the Administrator may charge a fee;
if the processed data becomes outdated or incomplete (or otherwise incorrect), you have the right to request its rectification;
in certain situations, you can ask the Administrator to delete your personal data, e.g. when:

the data will no longer be needed by the Administrator for the purposes of which he informed;
you have effectively withdrawn your consent to the processing of data - unless the Administrator has the right to process data on another legal basis;
the processing is unlawful;
the need to delete data results from the Administrator's legal obligation.

if personal data are processed by the Administrator on the basis of consent to processing or for the purpose of performing the Agreement concluded with him, you have the right to transfer your data to another administrator;
if personal data is processed by the Administrator on the basis of your consent to processing, you have the right to withdraw this consent at any time (withdrawal of consent does not affect the lawfulness of processing that was made on the basis of consent before its withdrawal);
if you consider that the processed personal data is incorrect, their processing is unlawful, or the Administrator no longer needs certain data, you can request that for a specific, necessary time (e.g. checking the correctness of data or pursuing claims) the Administrator does not perform any operations on the data, but only stores them;
you have the right to object to the processing of personal data whose basis for processing is the legitimate interest of the Administrator. In the event of an effective objection, the Administrator will cease to process personal data for the above-mentioned purpose;
you have the right to lodge a complaint with the President of the Office for Personal Data Protection if you believe that the processing of personal data violates the provisions of the GDPR.

The Administrator informs that the Store uses "cookies" installed on your end device. These are small text files that can be read by the Administrator's system, as well as by systems belonging to other entities whose services are used by the Administrator (e.g. Facebook, Google).
The administrator uses cookies for the following purposes:

ensuring the proper operation of the Store – thanks to cookies, it is possible to operate efficiently the Store, use its functions and conveniently move between individual subpages;
increasing the comfort of browsing the Store – thanks to cookies, it is possible to detect errors on some subpages and their constant improvement;
creating statistics – cookies are used to analyze how users use the Store. Thanks to this, it is possible to constantly improve the Store and adapt its operation to the preferences of users;
conducting marketing activities – thanks to cookies, the Administrator may direct advertisements tailored to users' preferences.

Your administrator can place both permanent and temporary (session) files on your device. Session files are usually deleted when you close the browser, but closing the browser does not delete persistent files.
Information about cookies used by the Administrator is displayed in the panel located at the bottom of the Store's website. Depending on your decision, you can enable or disable cookies of individual categories (except for necessary cookies) and change these settings at any time.
Data collected using cookies do not allow the Administrator to identify you.
The Administrator uses the following cookies or tools using them:

TOOL (1):

Necessary cookies

SUPPLIER:

Administrator

FUNCTIONS AND SCOPE OF DOWNLOADED DATA:

The operation of these files is necessary for the proper functioning of the Store's website, so you can not disable them. Thanks to these files (collecting, m.in. the IP number of your device), it is possible, m.in. to inform you about cookies operating on the Store's website.

PERIOD OF OPERATION:

Most of the necessary cookies are session cookies, but some remain on your device for a period of 12 months or until they are deleted

TOOL (2):

Necessary cookies

SUPPLIER:

Google

FUNCTIONS AND SCOPE OF DOWNLOADED DATA:

This tool allows you to collect statistical data on how customers use the Store, m.in. the number of visits, the duration of visits, the search engine used, location. The collected data helps to improve the Store and make it more friendly to customers.

PERIOD OF OPERATION:

Up to 2 years or until they are removed (whichever occurs first).

TOOL (3):

Facebook Pixel

SUPPLIER:

Facebook

FUNCTIONS AND SCOPE OF DOWNLOADED DATA:

This tool also allows you to determine that you have visited the Store, to direct ads displayed on Facebook and Instagram social networks to you and measure their effectiveness.

PERIOD OF OPERATION:

Up to 3 months or until they are removed (whichever occurs first).

Through most used browsers, you can check whether cookies have been installed on your end device, as well as delete installed cookies and block them from being installed by the Store in the future. Disabling or limiting the use of cookies may, however, cause quite serious difficulties in using the Store, e.g. in the form of the need to log in to each subpage, a longer loading period of the Store's website, restrictions on the use of certain functionalities.

Your rights under the California Consumer Privacy Act

The California Consumer Privacy Act (CCPA) provides you with rights regarding how your data or personal information is treated. Under the legislation, California residents can choose to opt out of the “sale” of their personal information to third parties. Based on the CCPA definition, “sale” refers to data collection for the purpose of creating advertising and other communications. Learn more about CCPA and your privacy rights.

How to opt out

By clicking on the link below, we will no longer collect or sell your personal information. This applies to both third-parties and the data we collect to help personalize your experience on our website or through other communications. For more information, view our privacy policy.
To be eligible to opt-out, you must be browsing from California.

Final provisions

To the extent not regulated by the Policy, generally applicable provisions on the protection of personal data shall apply.

This policy is effective from 16.02.2024.