Privacy policy
Information required under the GDPR
This section supplements the Privacy Policy and fulfils the information obligation under Art. 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR). In the event of any discrepancy between this section and the remainder of the Privacy Policy, this section prevails.
1. Data controller
The controller of your personal data is:
Dominik Zaręba
ul. Koralowa 13, 96-515 Paprotnia, Mazowieckie Voivodeship, Poland
operating the Bond & Being store (bondandbeing.com) under unregistered business activity
Email: info@bondandbeing.com
Phone: +48 721 903 005
We have not appointed a data protection officer. For all matters concerning personal data you may contact us directly at the email address above.
2. Purposes, legal bases and retention periods
| Purpose of processing | Legal basis | Retention period |
|---|---|---|
| Fulfilling the order and the contract of sale | Art. 6(1)(b) GDPR — necessary for the performance of a contract | Until fulfilment is complete, then until the periods indicated below expire |
| Keeping simplified sales records and tax settlements | Art. 6(1)(c) GDPR — legal obligation | 5 years from the end of the calendar year in which the tax payment deadline fell |
| Handling complaints and withdrawals from the contract | Art. 6(1)(c) GDPR — legal obligation | 2 years from delivery of the product (period of liability for lack of conformity) |
| Establishing, pursuing and defending against claims | Art. 6(1)(f) GDPR — legitimate interest | 6 years from the end of the year in which the order was fulfilled |
| Maintaining a customer account | Art. 6(1)(b) GDPR — performance of a contract for services provided electronically | Until you delete the account |
| Newsletter and marketing communication | Art. 6(1)(a) GDPR — your consent | Until consent is withdrawn |
| Own marketing and store analytics | Art. 6(1)(f) GDPR — legitimate interest | Until an effective objection is raised |
| Cookies and similar technologies (analytical, marketing) | Art. 6(1)(a) GDPR — your consent given in the cookie banner | According to the lifetime of individual files, up to 24 months |
| Handling correspondence and enquiries | Art. 6(1)(f) GDPR — legitimate interest | 3 years from the end of the correspondence |
| Fraud prevention and security | Art. 6(1)(f) GDPR — legitimate interest | Up to 3 years from the event |
3. Recipients of the data
We may share your personal data with the following categories of recipients, strictly to the extent necessary to achieve the purposes set out above:
| Category of recipient | Scope and purpose |
|---|---|
| Store platform provider — Shopify Inc. | Store hosting, order and customer account handling |
| Payment providers | Processing and settlement of payments |
| Carriers and logistics operators | Delivering the parcel — first name, surname, address, phone, email |
| Suppliers and manufacturers handling shipment (including outside the EEA) | Picking and dispatching the order — first name, surname, delivery address, phone |
| Marketing and analytics tool providers | Newsletter delivery, traffic measurement, advertising campaigns |
| Accounting and legal service providers | Settlements and handling of any disputes |
| Public authorities | Only on the basis of applicable law |
4. Transfers outside the European Economic Area
Some of your data may be transferred outside the European Economic Area. This applies in particular to:
- Shopify Inc. — servers and processors located, among others, in the United States and Canada;
- suppliers shipping products from outside the European Union — we pass on the data necessary to dispatch the parcel, i.e. first name, surname, delivery address and phone number.
Transfers to a third country take place on the basis of:
- standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR) — in relations with IT and marketing service providers, or
- necessity for the performance of the contract concluded with you (Art. 49(1)(b) GDPR) — where address data is passed to the entity shipping your order.
You can obtain a copy of the safeguards applied by writing to info@bondandbeing.com.
5. Your rights
You have the right to:
- access your data and obtain a copy of it (Art. 15 GDPR),
- rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR),
- erasure of data — the “right to be forgotten” (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability to another controller (Art. 20 GDPR),
- object to processing based on legitimate interest, including direct marketing (Art. 21 GDPR),
- withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR).
To exercise these rights, write to info@bondandbeing.com. We respond within one month of receiving the request.
6. Right to lodge a complaint
If you believe that we process your data unlawfully, you have the right to lodge a complaint with the supervisory authority:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
ul. Stawki 2, 00-193 Warsaw, Poland
uodo.gov.pl
If you live in another country of the European Economic Area, you may lodge a complaint with the supervisory authority competent for your place of residence.
7. Voluntary provision of data
Providing personal data is voluntary, however:
- providing the data needed to fulfil an order (first name, surname, delivery address, email address) is a condition for concluding and performing the contract — without it we cannot fulfil the order;
- providing an email address in order to receive the newsletter is entirely voluntary and does not affect your ability to make purchases.
8. Automated decision-making and profiling
We do not take decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
We may use profiling for marketing purposes — for example, selecting the product recommendations shown to you based on your browsing history. This has no effect on the price you pay or on the terms of the contract concluded. You may object to such processing at any time.
9. Cookies
The Store uses cookies:
- essential — necessary for the operation of the store, the cart and logging in; their use is based on our legitimate interest and does not require consent,
- analytical and marketing — used only after you have given consent in the cookie banner.
You may withdraw or change your consent at any time through the cookie settings available on the website and in your browser settings.
10. Data of minors
The Store is not intended for persons under 16 years of age and we do not knowingly collect their personal data. If you are a parent or guardian and believe that a child's data has been provided to us, write to info@bondandbeing.com — we will delete it without delay.