Regulations and Privacy Policy
of the Online Store
Privacy Policy
General Provisions
- Administrator – the company BM-PACK Bolesław Murdzek, Lubatowa 83a, 38-440 Lubatowa NIP 6841781826.
- User – any person using the website https://bmpack.pl/ on any device equipped with an internet browser.
Personal Data
The Administrator of the User’s personal data, as defined by personal data protection regulations, is BM-PACK Bolesław Murdzek, Lubatowa 83a, 38-440 Lubatowa NIP 6841781826.
The purposes, legal bases, and period for processing personal data are indicated separately for each processing purpose.
Rights.
The GDPR grants you the following potential rights related to the processing of your personal data:
- the right to access personal data,
- the right to rectification of personal data,
- the right to erasure of personal data,
- the right to restriction of processing of personal data,
- the right to object to the processing of personal data,
- the right to data portability,
- the right to lodge a complaint with a supervisory authority,
- the right to withdraw consent to the processing of personal data, if such consent has been given.
The rules related to the exercise of the indicated rights are described in detail in Articles 16 – 21 of the GDPR.
The User may request information about what data the Administrator holds about them and for what purposes it is processed. In such cases, please contact the Administrator at biuro@bmpack.pl. This email address can also be used for any questions regarding the processing of the User’s personal data.
Security
The Administrator guarantees the confidentiality of all personal data provided. Personal data is collected with due diligence and appropriately protected against unauthorized access.
Data Recipients
The User’s data may be processed by subcontractors acting on behalf of the Administrator (BM-PACK Bolesław Murdzek), i.e., entities whose services the Administrator uses when providing services to the User.
- Cyber_Folks S.A. with its registered office in Poznań, ul. Wierzbięcice 1B, 61-569 Poznań, entered into the National Court Register by the District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register under KRS number 0000685595, REGON 367731587, NIP 7792467259 – for the purpose of storing personal data on the server, including the mailbox server,
- Google LLC – for the purpose of using Google services, including email functioning based on Google servers,
All entities to whom the Administrator entrusts the processing of personal data guarantee the application of appropriate personal data protection and security measures required by law.
Due to the use of Google services, your data may be transferred to the United States of America (USA) in connection with its storage on American servers. Google has joined the Privacy Shield program and thereby guarantees an appropriate level of personal data protection required by European regulations.
Purposes and Processing Activities
Use of the https://bmpack.pl/ website
The personal data of all persons using the Website (including IP address or other identifiers and information collected via cookies or other similar technologies) who are not registered Users (i.e., persons without a profile on the Website) are processed by the Administrator:
- for the purpose of providing electronic services in the scope of making content collected on the Website and contact forms available to Users – the legal basis for processing is the necessity of processing for the performance of the contract (Art. 6 section 1 letter b of the GDPR);
- for the marketing purposes of the Administrator and other entities, in particular related to the presentation of behavioral advertising – the rules for processing personal data for marketing purposes are described in the “MARKETING” section.
The User’s activity on the Website, including their personal data, is recorded in system logs (a special computer program used to store a chronological record containing information about events and actions concerning the IT system used by the Administrator to provide services). The information collected in the logs is processed in connection with the provision of services. The Administrator also processes it for technical purposes; in particular, data may be temporarily stored and processed to ensure the security and correct functioning of IT systems, e.g., in connection with performing backup copies, testing changes in IT systems, detecting irregularities, or protection against abuse and attacks.
Contact
When contacting BM-PACK Bolesław Murdzek via email, the User naturally provides their email address as the sender’s address. Furthermore, the User may include other personal data in the message content. Providing data is voluntary but necessary to establish contact.
The User’s data is processed in this case for the purpose of contacting the User, and the basis for processing is Art. 6 section 1 letter a of the GDPR, i.e., the User’s consent resulting from initiating contact. The legal basis for processing after contact is concluded is a legitimate interest in the form of archiving correspondence to demonstrate its course in the future (Art. 6 section 1 letter f of the GDPR).
The content of the correspondence may be archived, and the Administrator is unable to unequivocally determine when it will be deleted. The User has the right to demand access to the history of correspondence conducted with the Administrator (if it was archived), as well as to demand its deletion, unless its archiving is justified due to the Administrator’s overriding interest, e.g., defense against potential claims from the User.
Contact Forms
The Administrator provides the possibility of contacting them using electronic contact forms. Using the form requires providing personal data necessary to contact the User and respond to the inquiry. The User may also provide other data to facilitate contact or handle the inquiry. Providing data marked as mandatory is required to accept and handle the inquiry, and failure to provide it results in the inability to handle the request. Providing other data is voluntary.
Personal data is processed: to identify the sender and handle their inquiry sent through the provided form – the legal basis for processing is the necessity of processing for the performance of the service contract (Art. 6 section 1 letter b of the GDPR);
Marketing
The Administrator processes the personal data of Users for the purpose of conducting marketing activities. In some cases, the Administrator uses profiling, e.g., ad remarketing. This means that, through automated data processing, the Administrator assesses selected factors concerning natural persons to analyze their behavior or create a future forecast.
Server Logs
Using the website involves sending requests to the server where the website is stored. Each request directed to the server is recorded in the server logs.
The logs include, among others, the User’s IP address, the date and time of the server, and information about the internet browser and operating system used by the User. The logs are saved and stored on the server.
The data stored in the server logs are not associated with specific individuals using the website and are not used by the Administrator to identify the User.
Server logs constitute only auxiliary material used for website administration, and their content is not disclosed to anyone except persons authorized to administer the server.
Comments
If the User wishes to add a comment on the website, they must fill out a form and provide their email address and name. Providing data is voluntary but necessary to add a comment.
The data provided when adding a comment is used to publish the comment on the website, and the legal basis for its processing is the User’s consent (Art. 6 section 1 letter a of the GDPR) resulting from adding the comment.
The data will be processed for the duration of the comments’ functionality on the website, unless the User requests the comment to be deleted sooner, which will result in the deletion of the User’s data from the database.
The User may rectify their data assigned to the comment or request its deletion at any time.