Privacy Policy

Who we are and how to find us

The administrator of your personal data is OPTISOFA Kasprzak limited partnership based in Andrychów (address: Przemysłowa 62, 34-120 Andrychów, Poland), registered in the National Court Register kept by the District Court for Kraków-Śródmieście, XII Economic Department, under the KRS number: 0000943369, identified by REGON numbers: 070764770 and NIP: 5511688299.

For all matters concerning the protection of your personal data, you can contact the administrator via email: sklep@optisofa.com or by phone: +48 692 437 990.

How and why we process your personal data

CUSTOMERS OF THE ONLINE STORE

If you are a customer of our online store, we process your personal data in order to perform the contract and for purposes related to the performance of accounting and tax obligations as well as those arising from consumer law.
The legal basis for processing your personal data is therefore Article 6(1)(b) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as "GDPR"), ("processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract") and Article 6(1)(c) of the GDPR ("processing is necessary for compliance with a legal obligation to which the controller is subject").

PERSONS ORDERING FABRIC SAMPLES

We invite you to try our fabrics. On the website, you will find special forms allowing you to order samples. By contacting us for this purpose, you provide us with your personal data necessary to deliver the fabric samples to you. Providing this data is voluntary but necessary to receive samples.
The legal basis for processing your personal data, which you provide when ordering fabric samples, is Article 6(1)(f) of the GDPR ("processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party"). The legitimate interest pursued here is the desire to provide individuals interested in fabric samples before purchasing our products in the online store.

RECIPIENTS OF PURCHASED PRODUCTS AND ORDERED FABRIC SAMPLES

If you are identified as the recipient of products purchased by customers of our online store or ordered fabric samples (sometimes a customer specifies a family member, neighbor, concierge, employee, etc. as the person who will receive the products ordered by them), the processing of your personal data is based on the legal basis of Article 6(1)(f) of the GDPR, i.e., on the basis of the legitimate interests pursued by the controller ("processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party").
The legitimate interest pursued here is the desire to fulfill the contract with the customer who has indicated you as the recipient of the purchased products or ordered fabric samples. In good faith, we assume that the customer has agreed with you before providing us with your data, or that receiving shipments is part of your job duties. We infer from this that by processing your data in the manner described here, we do not do so for purposes other than those for which our customer obtained your data from you.

CONTACT

By contacting us, you provide us with your personal data, including data contained in the content of correspondence or provided during a telephone conversation. Providing this data is voluntary but necessary to establish contact with us.
The legal basis for processing your personal data, which you provide when contacting us, is Article 6(1)(f) of the GDPR ("processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party"). The legitimate interest pursued here is contacting customers of our online store and the desire to respond to inquiries made by individuals interested in our products and the operation principles of our store.

NEWSLETTER

If you are a subscriber to our newsletter, we process your personal data to send it to you with your consent. The newsletter may contain paid promotions, commercial offers, industry information, and advertisements.
The legal basis for processing your personal data for this purpose is Article 6(1)(a) of the GDPR ("the data subject has given consent to the processing of his or her personal data for one or more specific purposes").
You can withdraw your consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal), including by unchecking the appropriate checkbox in your account settings.

SERVICE USERS (OPERATIONAL DATA)

We process data of each user of our service that characterizes their way of using our website (these are so-called operational data). This processing includes the automatic reading of a unique identifier identifying the end of a telecommunications network or IT system from which you are using (i.e., your IP address), as well as the date and time of the server, information about the technical parameters of the software and device you are using (e.g., whether you are browsing our site from a laptop or a phone), as well as the location from which you connect to our server. This information may be used by us for market research purposes and to improve the operation of the website. The data stored in server logs are not associated with specific individuals using the service. Server logs are solely auxiliary material used for administering the site.
The legal basis for processing operational data is Article 6(1)(f) of the GDPR ("processing is necessary for the purposes of the legitimate interests pursued by the controller"). The legitimate interest pursued here is to enable error diagnostics on the website and improve its quality.

ADMINISTRATOR'S SERVICES MARKETING

With separate consent obtained, we may process your personal data for marketing purposes, including inviting you to participate in organized promotions and sending you other commercial, advertising, or marketing information, as well as inviting you to express your opinion about our store in online review services.
The legal basis for processing your personal data for these purposes is Article 6(1)(a) of the GDPR ("the data subject has given consent to the processing of his or her personal data for one or more specific purposes"). You can withdraw your consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal), including by unchecking the appropriate checkbox.
In some cases, the legal basis for processing your personal data for direct marketing purposes may be the legitimate interest of the controller (Article 6(1)(f) of the GDPR – "processing is necessary for the purposes of the legitimate interests pursued by the controller" and Recital 47 of the GDPR – "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest"). According to Recital 47 of the GDPR, such a legitimate interest may exist when there is a significant and appropriate relationship between the data subject and the controller – for example, when the data subject is a customer of the controller. Remember that you always have the right to object at any time and free of charge to such processing, both initial and further, including profiling, if it is related to direct marketing. After objecting to the processing of personal data for direct marketing purposes, the controller may no longer process your data for such purposes.
You also have the right to withdraw the consent to receive commercial information at any time and free of charge. Withdrawal of consent does not affect the lawfulness of actions performed on the basis of consent before its withdrawal.

CLAIMS HANDLING

The content of correspondence conducted with you and information related to the execution of the agreement may be subject to archiving. You have the right to request the presentation of the history of correspondence you have conducted with us and the history of purchases (if archived), as well as demand its deletion, unless its archiving is justified due to our overriding interests.
The legal basis for processing your personal data by us after contact with us or the performance of the agreement connecting us is our legitimate interest. We may therefore process your personal data to establish, investigate, and defend against claims, ensure our ability to prove in the event of a dispute with you the content of the agreement connecting us and that we have properly executed it, based on Article 6(1)(f) of the GDPR ("processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party").

Like almost all other websites, we use cookies. Cookies are small text information stored on your end device (e.g., computer, tablet, smartphone) that can be read by our IT system.

Cookies allow us to:

a) ensure the proper functioning of the site,
b) improve the speed and security of using the site, use analytical tools,

use marketing tools, including those that involve profiling within the meaning of the GDPR.
We use cookies based on your consent, except when cookies are necessary for the proper provision of electronic services to you.
In the situations specified in points 1, 2, and 3 above, the information contained in cookies is processed on the basis of Article 6(1)(f) of the GDPR ("processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party"). The legitimate interest here is to ensure the proper functioning of the service, as well as to monitor and analyze traffic and maintain visitor statistics on the site.
In the situation specified in point 4 above (i.e., in the case of processing your personal data for marketing purposes, i.e., for advertising, market research, and your behaviors and preferences with the aim of improving the quality of our services), the information contained in cookies is processed based on Article 6(1)(a) of the GDPR ("the data subject has given consent to the processing of his or her personal data for one or more specific purposes").
Additionally, cookies can be divided into proprietary and third-party cookies. Our service uses functions provided by third parties, which may involve the use of cookies or other similar technologies from third parties (which means that these entities may, for example, place cookies on your device and access information collected by cookies). These third parties are our trusted partners with whom we continuously cooperate to tailor advertisements on our and their websites to your needs and interests, as well as the services we provide with our trusted partners.
During your first visit to the site, information about the use of cookies is displayed. Acceptance or closing of this information means that you consent to the use of cookies in accordance with the provisions of this privacy policy for all purposes described above. You can always withdraw your consent (without affecting the lawfulness of processing before withdrawing consent), delete cookies, and change cookie settings in your browser. However, please note that disabling cookies may cause difficulties in using the service, as well as many other websites that use cookies.
Importantly, you are not obliged to provide us with information contained in cookies. This can be prevented by deleting cookies and changing cookie settings in your web browser. Resignation from cookies usually concerns only a specific browser – this means that the same actions will have to be taken for each other browser used by you on the same or different device.
You can also use tools allowing for bulk management of cookie settings and browser plugins allowing for control over cookies. Internet browsers also offer the possibility to use the so-called "incognito mode", which allows visiting websites without saving in the browser history information about visited sites and downloaded files. Cookies created in incognito mode are generally deleted when all windows of this mode are closed.
However, disabling cookies may cause difficulties in using the Service, as well as many other websites that use cookies.

What data do we process

We can process the following categories of data:

Customers of our online store:

a) First and last name,
b) Entrepreneur's company name,
c) Phone number,
d) Email address,
e) Residential address,
f) Business address,
g) Shipping address for products,
h) Purchase history,
i) Data necessary for issuing invoices or VAT invoices,
j) Data related to payments for products ordered by customers,
k) Data stored in customer accounts (for registered users),
l) Data related to filing and consideration of complaints.

Recipients of products purchased in the online store or ordered fabric samples:

m) First and last name,
n) Entrepreneur's company name,
o) Delivery address,
p) Email address,
q) Phone number.

Newsletter subscribers:

r) Email address,
s) Information about the recipient's response to the sent newsletter (including whether and when the newsletter email was read).

People contacting us:

t) First and last name,
u) Email address,
v) Phone number,
w) Other personal data that may be included by the sender in the message content or attached documents or provided during a phone call.

All service users:

x) IP address,
y) Server date and time,
z) Location of the end device from which the user connects to the service,
aa) Technical parameters of the device and software used by the user,
bb) Content viewed on the service (navigation between subpages of the online store),
cc) Data about the source from which the user accessed the service,
dd) Geographical location (country only),
ee) Preferred language (device interface language),
ff) Mouse actions (movements, locations, clicks) and keystrokes,
gg) URL of the reference link and its domain,
hh) Device screen resolution,
ii) Online identifiers, including cookie identifiers, internet protocol addresses, and device identifiers.

Who do we disclose your personal data to

In our business operations, we use the support of specialized external entities that may or must have access to some of your data. These include:

Carriers or freight forwarders: In the case of a customer using postal or courier delivery for products purchased in the online store, the administrator may provide the collected personal data of the customer to selected carriers, freight forwarders, or intermediaries handling shipments on behalf of the administrator. This is done to facilitate product delivery to the customer or to verify complaints related to product delivery.
Entities handling electronic or card payments: If electronic or card payments are available in the online store, the administrator may provide the collected personal data of the customer to selected entities handling these payments on behalf of the administrator. This is necessary to process payments made by customers.
Providers of technical, IT, and organizational solutions: These providers supply the administrator with solutions enabling the operation of the business, including the online store and services provided through it. This includes providers of software for the online store, email services, hosting, as well as software for business management and technical support.
Providers of accounting, legal, and advisory services: This includes accounting firms, law firms, or debt collection agencies providing services to the administrator.
Services offering repair of products sold by the administrator: If a customer reports defects or faults in a purchased product, the administrator may provide personal data to the repair service for the purpose of addressing the complaint or fulfilling repair requests.
Hosting of personal data: Personal data of online store users is processed in an IT system located in part of a public cloud provided by third parties responsible for hosting the online store and email services.
Disclosure to public administration authorities: Personal data of online store customers may be disclosed to public administration authorities as required by law, such as tax authorities.
Transfers to third countries: Some of the operations described above may involve transferring your personal data to third countries outside the European Economic Area (EEA) where the General Data Protection Regulation (GDPR) does not apply. However, such transfers are always based on legal instruments provided for in the GDPR, ensuring adequate protection of your rights and freedoms.

How long will we process your personal data

When you enter into an agreement with us (by purchasing products in our online store), we will process your personal data for the duration of this agreement and after its termination for the period required by relevant tax regulations or for the duration of the statute of limitations for claims related to the agreement (whichever is longer).
If we cooperate with you on a regular basis (e.g., by managing an account for you on the website), then naturally, we will process certain necessary data for the entire duration of our cooperation.
Likewise, if you are entitled to any post-sale rights based on legal provisions or agreements, we must process your personal data for the entire duration of these rights in order to provide assistance if necessary.
In the event of you filing a complaint, your personal data will be stored for the time necessary to process it, but no longer than the statute of limitations for claims arising from the complaint or the period of final resolution of disputes concerning claims arising from the complaint.
Personal data provided to us through communication methods chosen by you will be stored no longer than necessary to provide you with a response, and after this time, may be kept for the period of statute of limitations for claims as determined by relevant regulations.
Processing of personal data of newsletter subscribers continues until the subscriber withdraws consent for the subscription by unsubscribing from the subscriber list.
Processing of your personal data contained in cookies lasts until you disable their use. You can do this by deleting cookies and changing cookie settings in your browser.
Processing of your data based on consent as the legal basis lasts until consent is withdrawn.

How we enable you to exercise your rights

We make every effort to ensure your satisfaction with our cooperation. However, please remember that you have many rights that allow you to influence how we process your personal data, and in some cases, to request the cessation of such processing. These rights include

Right of access to personal data (regulated by Article 15 of the GDPR)

Article 15

Right of access by the data subject

The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, access to the personal data and the following information:

the purposes of the processing;

the categories of personal data concerned;

the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;

the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;

the right to lodge a complaint with a supervisory authority;

where the personal data are not collected from the data subject, any available information as to their source;

the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4), and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.

The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.

Right to rectification (regulated by Article 16 of the GDPR)

Article 16

Right to rectification

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Right to erasure ('right to be forgotten') (regulated by Article 17 of the GDPR)

Article 17

Right to erasure ('right to be forgotten')

The data subject shall have the right to obtain from the controller the erasure of personal data concerning them without undue delay, and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) the data subject withdraws consent on which the processing is based according to Article 6(1)(a) or Article 9(2)(a), and where there is no other legal ground for the processing;
c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
d) the personal data have been unlawfully processed;
e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1).

Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

a) for exercising the right of freedom of expression and information;
b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c) for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) as well as Article 9(3);
d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
e) for the establishment, exercise or defence of legal claims.

Right to restriction of processing (regulated by Article 18 of the GDPR)

Article 18

Right to restriction of processing

The data subject shall have the right to obtain from the controller restriction of processing in the following cases:

a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
b) the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.

Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

The data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction of processing is lifted.

Right to object to processing (regulated by Article 21 of the GDPR)

Article 21

Right to object

The data subject shall have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on Article 6(1)(e) or (f), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning them for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

At the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any other information.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data subject may exercise their right to object by automated means using technical specifications.

Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to their particular situation, shall have the right to object to processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Right to data portability (regulated by Article 20 of the GDPR)

Article 20

Right to data portability

The data subject has the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used, and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:

a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) or on a contract pursuant to Article 6(1)(b); and
b) the processing is carried out by automated means.

In exercising the right to data portability under paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.

The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. This right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.

To exercise any of the rights described, please contact us by sending an email to: sklep@optisofa.com. You can also contact us by phone at: +48 692 437 990.

Complaint to the supervisory authority

Pursuant to Article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, your place of work, or the place where the alleged infringement occurred, if you believe that the processing of personal data concerning you violates the provisions of the GDPR.
In Poland, the supervisory authority is the President of the Personal Data Protection Office. Detailed information can be obtained on the website of the Personal Data Protection Office at: https://uodo.gov.pl/
If you wish to contact another supervisory authority responsible for data protection, please visit the website of the European Data Protection Board: https://edpb.europa.eu/about-edpb/about-edpb/members_pl

Is providing data necessary to enter into a contract with us?

We collect your personal data primarily to the extent necessary to enter into and perform the contract. Some data is also necessary for us to fulfill our obligations under the law (tax regulations, accounting regulations, post-sales obligations). In this case, failure to provide your personal data unfortunately will prevent the conclusion and execution of the contract.
Providing selected personal data by you when contacting us through your chosen communication channel is entirely voluntary but necessary to respond to your inquiry.
Providing your personal data to subscribe to our newsletter is entirely voluntary but necessary if you want to regularly receive information about our activities and online store electronically.
You are also not required to provide us with information contained in cookies. You can prevent this by deleting cookies and changing cookie settings in your browser. However, please note that changing cookie settings in a way that blocks the use of the information contained in them may cause difficulties in using the service.

Where do we get your personal data from?

We obtain personal data of customers of our online store and individuals contacting us solely from those individuals themselves.
Personal data of recipients of products purchased in our online store or ordered fabric samples are obtained exclusively from customers of the online store who have designated specific individuals as recipients of purchased products or ordered samples.
Usage data and data related to the use of cookies are obtained automatically (usually, however, these are not personal data within the meaning adopted by the GDPR).

Automated Processing and Profiling

Usage data and data related to the use of cookies may be processed in an automated manner within the meaning adopted by the GDPR.
Data processed for advertising and marketing purposes, through dedicated tools for this purpose, may be subjected to profiling within the meaning adopted by the GDPR. In such cases, profiling may aim to tailor sales offers to the user's preferences (based on, among other factors, previous purchases or previously viewed offers).
Other data collected in connection with the use of the service, including user data and data of individuals contacting us, are not processed in an automated manner or subjected to profiling.

Stay in touch with us. Subscribe to the newsletter and you will be the first to know about new products and discount coupons.

By subscribing to the newsletter, you agree to the terms contained in Regulaminie