VIKING-EUROPE.COM ONLINE STORE

TABLE OF CONTENTS: 

1.       GENERAL PROVISIONS

2.       BASIS OF DATA PROCESSING

3.       PURPOSE, BASIS, AND PERIOD OF DATA PROCESSING IN THE ONLINE STORE

4.       DATA RECIPIENTS IN THE ONLINE STORE

5.       PROFILING IN THE ONLINE STORE

6.       RIGHTS OF THE INDIVIDUAL WHOSE DATA IS PROCESSED

7.       COOKIES IN THE ONLINE STORE AND ANALYTICS

8.       FINAL PROVISIONS

1.     P GENERAL PROVISIONS 
1.1.            This Privacy Policy for the Online Store is informative, meaning that it is not a source of obligations for Service Recipients or Customers of the Online Store. The Privacy Policy primarily outlines the principles of processing personal data by the Administrator in the Online Store, including the legal basis, purposes, and duration of personal data processing, as well as the rights of individuals whose data is processed. It also provides information on the use of Cookies and analytical tools in the Online Store.
1.2.            The data administrator for personal data collected through the Online Store is LARIX JANUSZ PIEŁA LIMITED PARTNERSHIP-AJOINT STOCK COMPANY with its registered office in Bielsko-Biała (address: ul. Elizy Orzeszkowej 40, 43-300 Bielsko-Biała, Poland; and mailing address: ul. Bielska 1124, 43-374 Buczkowice, Poland); registered in the National Court Register under the number KRS 0000950849; the court where the company's documentation is kept: District Court in Bielsko-Biała, VIII Economic Department of the National Court Register; share capital: PLN 50,000, fully paid; NIP: 5471948356; REGON: 072740844, email address: info@viking-europe.com, and contact phone number: +48 33 828 18 30 - hereinafter referred to as the "Administrator," also serving as the Service Provider of the Online Store and the Seller.
1.3.            Contact details of the data protection officer appointed by the Administrator: Bogusława Tarnawa, email address: ado@larix.com.pl.
1.4.            Personal data in the Online Store is processed by the Administrator in accordance with applicable laws, especially Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) – hereinafter referred to as "GDPR" or "GDPR Regulation." Official text of the GDPR: http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679
1.5.            In the case where the provision of personal data by the Customer is necessary for the transfer of personal data to Twisto Polska Sp. z o.o. before concluding a Sales Agreement in the Online Store, providing this data is a condition for concluding the Sales Agreement in connection with the business model adopted by the Online Store. In the case of providing the Customer's personal data to Twisto Polska Sp. z o.o. in connection with the possibility of offering the Customer to pay the price for the purchased Product by Twisto Polska Sp. z o.o. under a mandate agreement covering the "Buy with Twisto" purchasing formula and making this formula available by the Online Store, providing this data and processing it for this purpose is required in connection with the business model adopted by the Online Store and to fulfill the agreement between the Online Store and Twisto Polska Sp. z o.o.
1.6.            In the case of providing the Customer's personal data to ING Bank Śląski S.A. in connection with the handling and settlement of payments made by the Customer using the iMoje service on the Internet for the Online Store using payment instruments, providing data is required to process payments and provide confirmation of its completion by the bank to the Online Store. In the case of providing personal data to ING Bank Śląski S.A. for verification by ING Bank Śląski S.A. of the proper performance of agreements concluded with the Online Store, especially ensuring the protection of payers' interests in connection with their complaints, providing this data is required to enable the execution of the agreement between the Online Store and the bank.
1.7.            Using the Online Store, including making purchases, is voluntary. Similarly, providing personal data by the Service Recipient or Customer using the Online Store is voluntary, with two exceptions: (1) entering into agreements with the Administrator – failure to provide the necessary data in the cases and to the extent indicated on the Online Store's website and in the Online Store Regulations and this Privacy Policy necessary to conclude and perform the Sales Agreement or the agreement for the provision of an Electronic Service with the Administrator will result in the inability to conclude this agreement. Providing personal data is a contractual requirement, and if the person whose data it is wants to conclude a specific agreement with the Administrator, they are obliged to provide the required data. The scope of data required to conclude the agreement is indicated on the Online Store's website and in the Online Store Regulations each time; (2) legal obligations of the Administrator – providing personal data is a legal requirement resulting from generally applicable laws imposing on the Administrator the obligation to process personal data (e.g., processing data for tax or accounting purposes), and failure to provide them will prevent the Administrator from fulfilling these obligations.
1.8.            The Administrator takes special care to protect the interests of individuals whose personal data is processed, and is responsible for ensuring that the data collected by them is: (1) processed lawfully; (2) collected for specified, lawful purposes, and not further processed in a manner incompatible with those purposes; (3) factually correct and adequate in relation to the purposes for which they are processed; (4) stored in a form that permits the identification of the individuals they concern for no longer than is necessary for the purposes of processing; and (5) processed in a way that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and accidental loss, destruction, or damage, using appropriate technical or organizational measures.
1.9.            Taking into account the nature, scope, context, and purposes of processing as well as the risk of varying likelihood and severity of the rights and freedoms of natural persons, the Administrator implements appropriate technical and organizational measures to ensure that the processing complies with the GDPR and to demonstrate this. These measures are reviewed and updated as needed. The Administrator uses technical measures to prevent unauthorized access and modification of personal data transmitted electronically.
1.10.         All words, phrases, and acronyms appearing in this privacy policy and starting with a capital letter (e.g., Seller, Online Store, Electronic Service) should be understood according to their definition contained in the Online Store Regulations available on the Online Store's website
2.     B ASIS OF DATA PROCESSING 
2.1.            The Administrator is entitled to process personal data when – and to the extent that – at least one of the following conditions is met: (1) the person whose data it is has given consent to the processing of their personal data for one or more specified purposes; (2) processing is necessary for the performance of a contract to which the person whose data it is is a party or to take steps at the request of the person whose data it is prior to entering into a contract; (3) processing is necessary to fulfill a legal obligation incumbent on the Administrator; or (4) processing is necessary for the purposes of the legitimate interests pursued by the Administrator or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the person whose data it is, requiring the protection of personal data, in particular where the person whose data it is is a child.
2.2.            2.2. The processing of personal data by the Administrator requires the existence of at least one of the grounds specified in point 2.1 of the privacy policy. The specific grounds for processing personal data of Service Recipients and Customers of the Online Store by the Administrator are indicated in the next point of the privacy policy – concerning the specific purpose of processing personal data by the Administrator. 
3.     PURPOSE, BASIS, AND PERIOD OF DATA PROCESSING IN THE ONLINE STORE 
3.1.            The purpose, basis, and period of processing, as well as the recipients of personal data processed by the Administrator, are determined by the actions taken by a particular Service Recipient or Customer in the Online Store or by the Administrator. For example, if a Customer decides to make purchases in the Online Store and chooses personal pickup of the purchased Product instead of courier delivery, their personal data will be processed for the purpose of fulfilling the concluded Sales Agreement but will not be shared with the carrier handling shipments on behalf of the Administrator.
3.2.            The Administrator may process personal data within the Online Store for the following purposes, on the legal bases, and for the periods indicated in the table below: 

3.3.            In connection with the launch of online payments in the Online Store as part of the iMoje service offered by ING Bank Śląski S.A. and the "Buy with Twisto" purchasing formula offered by Twisto Polska Sp. z o.o., the Administrator provides the following additional information related to the processing of the Customer's personal data using one of the aforementioned payment services through the Online Store:
3.3.1.       When the Customer uses the iMoje service for payments in the Online Store, the Administrator may transfer the personal data of Online Store Customers to ING Bank Śląski S.A. for the following purposes:

3.3.1.1.   In connection with the provision of the bank's service to the Online Store, making available infrastructure for online payment processing (legal basis: Art. 6(1)(f) GDPR);

3.3.1.2.   In connection with the bank's handling and settlement of payments made by Online Store Customers online using payment instruments (legal basis: Art. 6(1)(f) GDPR);

3.3.1.3.   In connection with the bank's verification of the proper execution of agreements concluded with the Online Store, especially ensuring the protection of payers' interests in relation to the complaints they submit (legal basis: Art. 6(1)(f) GDPR).

3.3.2.       When the Customer chooses to defer payment in the Online Store, the Administrator may transfer the personal data of Online Store Customers to Twisto Polska Sp. z o.o. for the following purposes:

3.3.2.1.   In connection with the possibility of proposing payment for the purchased goods or services by Twisto Polska Sp. z o.o. under a commission agreement covering the "Buy with Twisto" formula, and providing this purchasing formula by the Online Store, as well as for the purpose of verifying Twisto Polska Sp. z o.o.'s proper performance of such commission agreements (legal basis: Art. 6(1)(f) GDPR).

3.4.            Through the Online Store, the Administrator collects and processes the following personal data of Customers provided during the registration of an Account, placing an Order, or subscribing to the Newsletter in the Online Store: first and last name; email address; contact phone number; delivery address (street, house number, apartment number, postal code, city, country); residence/business address/headquarters (if different from the delivery address); for non-consumer Customers: company name and tax identification number (NIP). 
4.     DATA RECIPIENTS IN THE ONLINE STORE 
4.1.            For the proper functioning of the Online Store, including the fulfillment of concluded Sales Agreements, the Administrator needs to use the services of external entities (such as software providers, couriers, or payment processing entities). The Administrator only uses services of processing entities that provide sufficient guarantees of implementing appropriate technical and organizational measures to ensure that the processing meets the requirements of the GDPR and protects the rights of individuals whose data is processed.
4.2.            Personal data may be transferred by the Administrator to a third country, and the Administrator ensures that, in such a case, it will be done in relation to a country providing an adequate level of protection – in accordance with the GDPR. For other countries, the transfer will be based on standard data protection clauses. The Administrator ensures that the data subject has the opportunity to obtain a copy of their data. The Administrator transfers collected personal data only when necessary and to the extent necessary to achieve the specific purpose of data processing in accordance with this privacy policy.
4.3.            Data transfer by the Administrator does not occur in every case and not to all recipients or categories of recipients specified in the privacy policy – the Administrator transfers data only when necessary to achieve the specific purpose of personal data processing and only to the extent necessary for its realization. For example, if a customer opts for personal pickup, their data will not be transferred to the carrier cooperating with the Administrator.
4.4.            Personal data of Service Recipients and Customers of the Online Store may be transferred to the following recipients or categories of recipients:
4.4.1.       Carriers / freight forwarders / courier brokers / entities handling warehouse and/or shipping processes – in the case of a Customer using postal or courier delivery in the Online Store, the Administrator provides the collected personal data of the Customer to the selected carrier, freight forwarder, or intermediary handling shipments on behalf of the Administrator. If shipping is from an external warehouse, the data is provided to the entity handling the warehouse and/or shipping process, to the extent necessary for the delivery of the product to the Customer.

4.4.2.       Entities handling electronic payments or credit cards – in the case of a Customer using electronic payments or credit cards in the Online Store, the Administrator provides the collected personal data of the Customer to the selected entity handling these payments in the Online Store on behalf of the Administrator, to the extent necessary to process payments made by the Customer.

4.4.2.1.   In the case of electronic payments and credit cards as part of the iMoje service – ING Bank Śląski S.A. with its registered office in Katowice (address: ul. Sokolska 34, 40-086 Katowice, Poland); entered into the Register of Entrepreneurs of the District Court Katowice – East in Katowice, VIII Economic Department of the National Court Register under the number KRS 0000005459; share capital of PLN 130,100,000.00 fully paid up, NIP: 6340135475, REGON: 271514909.

4.4.3.       Credit providers – in the case of a Customer using the installment payment system in the Online Store, the Administrator provides the collected personal data of the Customer to the selected credit provider handling these payments in the Online Store on behalf of the Administrator, to the extent necessary to process payments made by the Customer.

4.4.3.1.   In the case of the "Buy with Twisto" deferred payment service – Twisto Polska Sp. z o.o. with its registered office in Warsaw (address: ul. Puławska 2, 02-566 Warsaw, Poland); entered into the Register of Entrepreneurs of the District Court for the capital city of Warsaw in Warsaw, XIII Economic Department of the National Court Register under the number KRS: 0000689624, NIP: 9512442875, REGON: 367977970, with a share capital of PLN 1,000,000.00.

4.4.4.       Providers of technical, IT, and organizational solutions enabling the Administrator to conduct business, including the Online Store and Electronic Services provided through it (especially providers of computer software for running the Online Store, email and hosting providers, and providers of software for managing the business and providing technical support to the Administrator) – the Administrator provides the collected personal data of the Customer to the selected provider acting on its behalf only when necessary and to the extent necessary to achieve the specific purpose of data processing in accordance with this privacy policy.

4.4.5.       Providers of accounting, legal, and advisory services providing support to the Administrator in accounting, legal, or advisory matters (especially accounting offices, law firms, or debt collection agencies) – the Administrator provides the collected personal data of the Customer to the selected provider acting on its behalf only when necessary and to the extent necessary to achieve the specific purpose of data processing in accordance with this privacy policy.

4.4.6.       Providers of social media plugins, scripts, and other similar tools placed on the Online Store's website that allow the visitor's browser to retrieve content from the providers of these plugins (e.g., logging in using social media credentials) – the Administrator collects and provides the personal data of the Service Recipient using the Online Store's website to Meta Platforms Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland) when using social media plugins from the Facebook service on the Online Store's website. This includes information about activities on the Online Store's website, such as device information, visited pages, purchases, displayed ads, and how the services are used, regardless of whether the Service Recipient has a Facebook account or is logged into Facebook. The processing is carried out in accordance with the privacy principles available here: https://www.facebook.com/about/privacy/..

5.     PROFILING IN THE ONLINE STORE 
5.1.            The GDPR imposes an obligation on the Administrator to inform about automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR. In these cases, the Administrator must provide essential information about the rules for making such decisions, as well as the significance and anticipated consequences of such processing for the person whose data is concerned. In this section of the privacy policy, the Administrator provides information about possible profiling.
5.2.            The Administrator may use profiling in the Online Store for direct marketing purposes, but decisions based on it by the Administrator do not concern the conclusion or refusal to conclude a Sales Agreement or the possibility of using Electronic Services in the Online Store. The result of using profiling in the Online Store may include, for example, granting a discount, sending a discount code, reminding of unfinished purchases, sending a product proposal that may match the interests or preferences of the individual, or offering better conditions compared to the standard Online Store offer. Despite profiling, the data subject freely decides whether to use the received discount or better conditions and make a purchase in the Online Store.
5.3.            Profiling in the Online Store involves the automatic analysis or prediction of the behavior of an individual on the Online Store's website, such as adding a specific product to the shopping cart, browsing a specific product page in the Online Store, or analyzing the individual's previous purchase history in the Online Store. The condition for such profiling is for the Administrator to have personal data of the individual to subsequently send, for example, a discount code.
5.4.            The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects the individual.
6.     RIGHTS OF THE DATA SUBJECT 
6.1.            Right of access, rectification, restriction, deletion, or portability – the data subject has the right to request from the Administrator access to their personal data, its rectification, deletion ("right to be forgotten"), or restriction of processing, and has the right to object to processing, as well as the right to data portability. Detailed conditions for exercising the aforementioned rights are specified in Articles 15-21 of the GDPR.
6.2.            Right to withdraw consent at any time – the data subject whose data is processed by the Administrator based on the expressed consent (under Article 6(1)(a) or Article 9(2)(a) of the GDPR) has the right to withdraw consent at any time without affecting the lawfulness of the processing based on consent before its withdrawal.
6.3.            Right to lodge a complaint with the supervisory authority – the data subject whose data is processed by the Administrator has the right to lodge a complaint with the supervisory authority in the manner and in the manner specified in the provisions of the GDPR and Polish law, in particular the Personal Data Protection Act. The supervisory authority in Poland is the President of the Office for the Protection of Personal Data.
6.4.            Right to object – the data subject has the right to object at any time, for reasons related to their particular situation, to the processing of their personal data based on Article 6(1)(e) (public interest or official authority) or (f) (legitimate interests of the controller), including profiling based on these provisions. In such a case, the Administrator may no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the data subject or the grounds for establishing, pursuing, or defending legal claims.
6.5.            Right to object to direct marketing – if personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data for such marketing, including profiling, to the extent that the processing is related to such direct marketing.
6.6.            To exercise the rights mentioned in this section of the privacy policy, you can contact the Administrator by sending a relevant message in writing or by email to the Administrator's address indicated at the beginning of the privacy policy or by using the contact form available on the Online Store's website 
7.     COOKIES IN THE ONLINE STORE AND ANALYTICS 
7.1.            Cookies are small text information in the form of text files sent by the server and stored on the side of the person visiting the Online Store's website (e.g., on the hard drive of a computer, laptop, or on the memory card of a smartphone – depending on the device used by the visitor of our Online Store). Detailed information about cookies and their history can be found, among other places, here: https://en.wikipedia.org/wiki/HTTP_cookie.
7.2.            Cookies that may be sent by the Online Store's website can be divided into various types, according to the following criteria:
With regard to the provider: 

1)    own (created by the Controller’s Online Shop website) and

2)    belonging to other persons/third parties (other than the Controller)
With regard to the period of their retention on the appliance of the Online Shop’s visitor: 

1)    session cookies (stored till the moment of closing of the Website or a browser) and

2)    persistent cookies (having some expiration period, defined by parameters of each file or until they are removed by hand)
With regard to the purpose of their usage: 

1) strictly necessary cookies (enabling proper functioning of the Online Shop website), 

2) functional/preferential cookies (enabling adjustment of the Online Shop website to the visitor’s preferences), 

3) analytical and performance cookies (collecting information on the use of the Online Shop website), 

4) targeting, advertising or social cookies (collecting information on the visitor of the Online Shop website in order to display personalised advertisements to such a person and for other marketing activities, including those performed on sites different from the Online Shop website, such as social networks).
7.3.            The Administrator may process data contained in Cookies when visitors use the Online Store's website for the following specific purposes:
Purposes of using Cookies on the Controller’s Online Shop website
Identification of the Service Recipients as logged in to the Online Shop and showing them that they are actually logged in (strictly necessary Cookies)
Saving Products added to the cart to place an Order (strictly necessary Cookies)
Saving data from the filled-in forms, questionnaires, or login data for the Online Shop (strictly necessary Cookies and/or functional/preferential Cookies)
Adjustment of the Online Shop website contents to individual preferences of the Service Recipient (e.g. colours, font size, layout) and optimisation of the use of the website (functional/preferential Cookies)
Keeping anonymous statistics presenting the visitor’s behaviours on the Online Shop website (statistical Cookies)
Remarketing, namely evaluating the conduct of visitors of the Online Store through anonymous analysis of their activities (e.g. repeated visits on particular pages, key words etc.) to create their profile and provide them with adverts matching their interests, also when they visit other websites in the advertising network of Google Ireland Ltd. and Meta Platforms Ireland Ltd. (marketing, advertising and social Cookies)
7.4.            Checking, in the most popular web browsers, which Cookies (including the duration of Cookie operation and their provider) are currently being sent by the Online Store's website can be done as follows:
In Chrome browser: 
(1) in the address bar, click the ’locked’ icon on the left, (2) go to the benchmark „Cookie files”.
In Firefox browser: 
(1) in the address bar, click the ’shield’ icon on the left, (2) go to the benchmark „Allowed” or „Blocked”, (3) click the button „Tracking cookies between websites”, „Tracing elements of social networks or „Content with tracing elements”
In Internet Explorer browser: 
(1) Click „Tools” menu, (2) go to „Internet options” benchmark, (3) go to „General” benchmark, (4) then go to „Settings”, (5) click the button „Display files”
In Opera browser: 
(1) in the address bar, click the ’locked’ icon on the left, (2) go to the benchmark „Cookie files”.
In Safari browser: 
(1) click menu „Preferences”, (2) go to „Privacy” benchmark, (3) click the button „Manage website data”
Independent of the browser used, you can apply tools available e.g. at: https://www.cookiemetrix.com/ or: https://www.cookie-checker.com/
7.5.            By default, most web browsers available on the market accept the storage of Cookies. Everyone has the option to determine the conditions for using Cookies through the settings of their web browser. This means that it is possible to, for example, partially limit (temporarily) or completely disable the possibility of storing Cookies – in the latter case, however, this may affect some functionalities of the Online Store (for example, it may be impossible to go through the Order path via the Order Form due to not remembering Products in the cart during subsequent steps of placing the Order).
7.6.            The settings of the web browser regarding Cookies are essential for giving consent to the use of Cookies by our Online Store – in accordance with the regulations, such consent can also be expressed through the settings of the web browser. Detailed information on changing settings related to Cookies and their independent deletion in the most popular web browsers is available in the help section of the web browser and on the following pages (just click on the respective link):
in Chrome browser
in Firefox browser
in Internet Explorer browser
in Opera browser
in Safari browser
in Microsoft Edge browser 
7.7.            The Administrator may use Google Analytics, Universal Analytics services provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) in the Online Store. These services help the Administrator compile statistics and analyze traffic on the Online Store. The collected data processed under these services is used to generate statistics helpful in administering the Online Store and analyzing traffic on the Online Store. This data is aggregate in nature. By using the above services in the Online Store, the Administrator collects data such as the sources and medium of acquisition of visitors to the Online Store, their behavior on the Online Store's website, information about the devices and browsers they use to visit the site, IP and domain, geographic data, as well as demographic data (age, gender), and interests. 
7.8.            It is possible for an individual to easily block the sharing of information about their activity on the Online Store's website with Google Analytics – for this purpose, one can, for example, install a browser add-on provided by Google Ireland Ltd., available here: https://tools.google.com/dlpage/gaoptout?hl=pl. 
7.9.            In connection with the possibility of the Administrator using advertising and analytical services provided by Google Ireland Ltd. in the Online Store, the Administrator points out that full information about the principles of processing data of visitors to the Online Store (including information stored in Cookies) by Google Ireland Ltd. can be found in the privacy policy of Google services available at: https://policies.google.com/technologies/partner-sites
8.     FINAL PROVISIONS 
8.1.            The Online Store may contain links to other websites. The Administrator encourages you to familiarize yourself with the privacy policy established on those other websites after transitioning to them. This privacy policy applies only to the Administrator's Online Store.