2. The Owner of the Online Store and data controller at the same time is Little Tuscany Sp. z o.o. with its registered seat in Łódź (90- 224), Pomorska 77 Street, Tax Identification Number: 7252302431, hereinafter referred to as Little Tuscany Sp. z o.o.
3. Personal data collected by Little Tuscany Sp. z o.o. via the Online Store are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), also referred to as GDPR.
4. Little Tuscany Sp. z o.o. is particularly careful to respect the privacy of the Customers visiting the Online Store.
§ 1 Type of Data Processed, Purposes and Legal Basis
1. The website processes your personal data for the following purposes:
(a) to carry out the services offered on the website,
b) transfer your personal data to ING Bank Śląski S.A. (“Bank”) in connection with
- provision by the Bank to the Online Store of the service of making available the infrastructure for handling payments via the Internet (legal basis: Article 6 (1)(f) of the Regulation).
- processing and settlement by the Bank of payments made by the Online Store’s customers via the Internet using payment instruments (legal basis: Article 6(1)(f) of the Regulation).
- In order for the Bank to verify proper execution of agreements concluded with the Online Store, in particular, to ensure the protection of the payers’ interests in connection with complaints filed by them (legal basis: Article 6(1)(f) of the Regulation).
c) transfer of your personal data to Twisto Poland Sp. z o.o. in connection with the possibility of offering payment for purchased goods or services by Twisto Poland Sp. z o.o. under a contract of the mandate which includes a purchasing formula “Buy with Twisto” and making this purchasing formula available in the Online Store, as well as for the purpose of verification by Twisto Poland Sp. z o.o. of the proper execution of such contracts of mandate (legal basis: art. 6, sec. 1, letter f) of the Regulation).
2. Customers’ personal data are collected in case of:
a) registration of an account in the Online Store, in order to create an individual account and manage this account. Legal basis: necessity to execute the agreement on providing the Account service (art. 6 par. 1 letter b of the Regulation);
b) placing an order in the Online Store, in order to execute the sales agreement. Legal basis: necessity to execute the sales agreement (Article 6(1)(b) GDPR).
(3) In the case of registration of an account in the Online Store, the Customer provides:
- e-mail address;
- address data:
- postal code and city;
- street along with the house/flat number.
- name and surname;
- telephone number.
4. In connection with the processing of personal data for the purposes specified in paragraph 2, your personal data can be made available by the online store to other recipients or categories of recipients of personal data, which may be: Twisto Polska sp. z o.o.
5. During the registration of an account in the Online Store, the Customer sets an individual password to access his/her account. The Customer can change the password, at a later time, on the principles described in § 5.
6. When placing an order in the Online Store, the Customer provides the following data:
- e-mail address;
- address data:
- zip code and city;
- street and house/flat number.
- name and surname;
- telephone number.
In case of Entrepreneurs, the above scope of data is additionally extended by:
- the Entrepreneur’s company;
- NIP number.
8. When using the Store website may be collected additional information, in particular: the IP address assigned to the Customer’s computer or an external IP address of the Internet provider, domain name, browser type, access time, operating system type.
9. Navigation data may also be collected from Customers, including information about links and references they choose to click on or other actions taken in our Online Store. Legal basis – a legitimate interest (Article 6(1)(f) GDPR), consisting of facilitating the use of services provided electronically and improving the functionality of these services.
10. For the purpose of establishing, investigation and enforcement of claims may process certain personal data provided by the Customer in the course of using the functionality of the Online Store, such as: name, surname, data on the use of services, if the claims arise from the manner in which the Customer uses the services, other data necessary to prove the existence of the claim, including the extent of damage suffered. Legal basis – a legitimate interest (Article 6(1)(f) GDPR), consisting of the establishment, investigation and enforcement of claims and defense against claims in proceedings before the courts and other state authorities.
11. Providing personal data to Little Tuscany Sp. z o.o. is voluntary, in connection with the conclusion of sales agreements or provision of services via the Store’s website, with the proviso, however, that failure to provide the data specified in the forms in the Registration process makes it impossible to register and set up a Customer Account, and in the case of placing an order without registering a Customer Account, it makes it impossible to place and process the Customer’s order.
§ 2 To whom is the data provided or entrusted and how long is the data stored?
1. The Customer’s personal data is transferred to the service providers used by Little Tuscany Sp. z o.o. for running the Online Store. The service providers to whom the personal data are transferred, depending on the contractual arrangements and circumstances, are either subject to the instructions of Little Tuscany Sp. z o.o. as to the purposes and means of processing such data (processors) or they themselves determine the purposes and means of processing (controllers).
a) Processors: Little Tuscany Sp. z o.o. uses Deliverers who process personal data exclusively on the instructions of Little Tuscany p. z o.o.. These include, but are not limited to, providers of hosting services, accounting services, providers of marketing systems, systems for analyzing traffic to the Online Store, systems for analyzing the effectiveness of marketing campaigns;
b) Controllers. Little Tuscany Sp. z o.o. uses providers who do not act solely on instructions and determine themselves the purposes and ways of using Customers’ personal data. They provide electronic payment and banking services.
2. Location. The service providers are primarily based in Poland and other countries in the European Economic Area (EEA).
3. Customers’ personal information is stored:
a) If the basis for the processing of personal data is consent then the Customer’s personal data are processed by Little Tuscany Sp. z o.o. as long as the consent is not revoked, and after revoking the consent for a period of time corresponding to the period of limitation of claims that Little Tuscany Sp. z o.o. may raise and that may be raised against it. Unless a specific provision of law provides otherwise, the period of limitation is six years, and for claims for periodic benefits and claims related to the conduct of business activity – three years.
b) If the basis of data processing is the performance of an agreement, then the Customer’s personal data are processed by Little Tuscany Sp. z o.o. as long as it is necessary for the performance of the agreement, and after that time for a period corresponding to the period of limitation of claims. If not specified otherwise, the period of limitation is six years, and for periodic performance claims and claims related to business activities – three years.
4. If you make a purchase in the Online Store, your personal data may be transferred, depending on your choice, in order to deliver the ordered goods to a courier company.
5. In case, when giving Your personal data by You takes place in order to transfer Your personal data to Twisto Polska Sp. z o.o. before the conclusion of a sale agreement of goods (or services) purchased in the Online Store; transferring those data is a condition of the conclusion of a contract of sale in connection with a business model adopted by the Online Store.
6. In the case of transferring your personal data to the Bank in connection with the processing and settlement of payments made by you to the Online Store via the Internet using payment instruments, providing the data is required in order to execute the payment and transfer the confirmation of its execution by the Bank to the Online Store.
7. In the case of transferring your personal data to the Bank in order for the Bank to verify the proper performance of agreements concluded with the Online Store, in particular to ensure the protection of interests of payers in connection with their complaints, providing this data is required in order to enable the execution of the agreement concluded between the Online Store and the Bank.
8. In case of giving your personal data to Twisto Poland sp. z o.o. in connection with the possibility of proposing you to pay the price for the purchased goods or services by Twisto Poland sp. z o.o. as part of an order agreement including a purchase formula “Buy with Twisto” and making this formula available by the Online Store, providing these data and processing them for this purpose is required in connection with the business model adopted by the Online Store and in order to carry out the agreement concluded between the Online Store and Twisto Polska Sp. z o.o.
9. The navigation data may be used in order to provide better service to the Customers, analyze statistical data and adjust the Online Store to the Customers’ preferences as well as to administer the Online Store.
10. If requested, Little Tuscany Sp. z o.o. shall make your personal data available to authorized state authorities, in particular to the organizational units of the Public Prosecutor’s Office, Police, the President of the Office for Personal Data Protection, the President of the Office for Competition and Consumer Protection, or the President of the Office for Electronic Communications.
3 § Cookies mechanism, IP address
1. The Online Store uses small files, called cookies. They are saved by Little Tuscany Sp. z o.o. on the end device of the person visiting the Online Store, if the Internet browser allows it. A cookie file usually contains the name of the domain it came from, its “expiry time” and an individual random number identifying the file. Information collected by means of files of this type help to adjust products offered by Little Tuscany Sp. z o.o. to individual preferences and real needs of persons visiting the Online Store. They also make it possible to prepare general statistics of visits to the presented products in the Online Store.
2. Little Tuscany Sp. z o.o. uses two types of cookies:
a) Session cookies: when the session of a given browser ends or the computer is switched off, the stored information is deleted from the memory of the device. The mechanism of session cookies does not allow the collection of any personal data or any confidential information from the Customer’s computer.
b) Persistent cookies: are stored in the memory of the Customer’s terminal equipment and remain there until they are deleted or expire. The mechanism of permanent cookies does not allow collecting any personal data or any confidential information from the Customer’s computer.
3. Little Tuscany Sp. z o.o. uses its own cookies in order to:
a) authenticating the Customer in the Online Store and ensuring a Customer session in the Online Store (after logging in), thanks to which the Customer does not have to enter his/her login and password again on each subpage of the Online Store;
b) analysis, research and audience audit, and in particular for creating anonymous statistics which help to understand how the Customers use the Online Store’s website, which enables improving its structure and content.
4. Little Tuscany Sp. z o.o. uses external cookies in order to:
a) collect general and anonymous statistical data by means of Google Analytics analytical tools (the administrator of external cookies: Google Inc. based in the USA);
b) The cookie mechanism is safe for the Online Store Customers’ computers. In particular, this way it is not possible for viruses or other unwanted software or malware to get into Customers’ computers. Nevertheless, the Customers have the possibility to limit or disable the access of cookies to their computers in their browsers. If this option is used, the use of the Online Store will be possible, except for the functions that by their nature require cookies.
d) Internet Explorer browser;
e) Microsoft EDGE browser;
f) Mozilla Firefox browser;
g) Chrome browser;
h) Safari browser;
i) Opera browser.
7. Little Tuscany Sp. z o.o. may collect IP addresses of the Customers. IP address is a number assigned to the computer of a person visiting the Online Store by the Internet service provider. IP number enables access to the Internet. In most cases, it is assigned to a computer dynamically, i.e. it changes each time the computer is connected to the Internet and for this reason, it is commonly treated as non-personal identification information. The IP address is used by Little Tuscany Sp. z o.o. for diagnosing technical problems with the server, creating statistical analyses (e.g. determining from which regions the most visits are recorded), as information useful for administration and improvement of the Online Store, as well as for security purposes and possible identification of server-overloading, unwanted automatic programmes for browsing the contents of the Online Store.
8. The Online Store contains links and references to other websites. Little Tuscany Sp. z o.o. is not responsible for the privacy protection rules applicable there.
4 § Rights of data subjects
1. Right to withdraw consent – legal basis: Article 7(3) of the GDPR.
a) The Customer has the right to revoke any consent given by Little Tuscany Sp. z o.o.
b) Withdrawal of consent has effect from the moment of withdrawal of consent.
c) Withdrawal of consent does not affect the processing performed by Little Tuscany Sp. z o.o. in accordance with the law before its withdrawal.
d) Withdrawal of consent does not entail any negative consequences for the Customer, however, it may prevent further use of services or functionalities which, according to the law, Little Tuscany Sp. z o.o. may provide only with consent.
e) Right to lodge a complaint to the authority – The Customer has the right to lodge a complaint to the supervisory authority dealing with personal data protection, which is the President of the Office for Personal Data Protection.
2. The right to object to data processing – legal basis: Article 21 GDPR.
a) The Customer has the right to object at any time – for reasons related to his/her particular situation – to the processing of his/her personal data, including profiling, if Little Tuscany Sp. z o.o. processes his/her data on the basis of legitimate interests, e.g. marketing of products and services of Little Tuscany Sp. z o.o., keeping statistics on the use of particular functionalities of the Online Store and facilitating the use of the Online Store, as well as satisfaction surveys.
b) Resignation from receiving marketing messages concerning products or services in the form of e-mail messages shall signify the Customer’s objection to the processing of his/her personal data, including profiling for these purposes.
c) If the Customer’s objection proves to be valid and Little Tuscany Sp. z o.o. has no other legal basis for processing the personal data, the Customer’s personal data will be deleted, against the processing of which the Customer has raised an objection.
3. The right to erasure (“right to be forgotten”) – legal basis: Article 17 of the GDPR.
The Customer has the right to request the erasure of all or some personal data. The Customer has the right to request the erasure of personal data if:
a) the personal data are no longer necessary for the purposes for which they were collected or for which they were processed;
b) he/she has withdrawn specific consent, to the extent that the personal data were processed on the basis of his/her consent;
c) objected to the use of his/her data for marketing purposes;
d) the personal data is being processed unlawfully;
e) the personal data must be erased in order to comply with a legal obligation provided for by Union law or the law of a Member State to which Little Tuscany Sp. z o.o. is subject;
f) the personal data was collected in connection with the offering of information society services.
g) Despite a request for the erasure of personal data, due to an objection or withdrawal of consent, Little Tuscany Sp. z o.o. may retain certain personal data to the extent that the processing is necessary for the establishment, assertion or defense of claims, as well as for complying with a legal obligation requiring processing under Union law or the law of a Member State to which Little Tuscany Sp. z o.o. is subject. This applies in particular to the following personal data: first name, surname, e-mail address, which data are stored for the purposes of examining complaints and claims related to the use of services of Little Tuscany Sp. z o.o., or additionally home address/correspondence address, order number, which data are stored for the purposes of examining complaints and claims related to the concluded sales contracts or provision of services.
4. The right to restrict data processing – legal basis: Article 18 GDPR.
a) The Customer has the right to request the restriction of the processing of his personal data. The submission of the request, until it is considered, prevents the use of certain functionalities or services, the use of which will be associated with the processing of data covered by the request. Little Tuscany Sp. z o.o. shall not send any messages, including marketing ones.
b) The Customer has the right to request the restriction of the use of personal data in the following cases:
c) when he/she questions the correctness of his/her personal data – then Little Tuscany Sp. z o.o. shall limit their use for the time necessary to verify the correctness of the data, but no longer than for 7 days.
d) when the processing of the data is unlawful, and instead of deleting the data the Customer requests to limit its use.
e) when the personal data is no longer necessary for the purposes for which it was collected or used, but it is necessary for the Customer to establish, assert or defend his/her claims.
f) when the Customer raised an objection to the use of his/her data – then the restriction is made for the time needed to consider whether, due to the particular situation, the protection of the Customer’s interests, rights, and freedoms outweigh the interests pursued by the Controller while processing the Customer’s personal data.
5. Right of access – legal basis: article 15 of the GDPR.
The Customer has the right to obtain confirmation from the Controller as to whether it is processing personal data, and if this is the case, the Customer has the right to:
a) gain access to his/her personal data.
b) obtain information about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients of such data, the planned period for which the Customer’s data are to be stored, or the criteria for determining this period (if it is not possible to determine the planned period of data processing), the Customer’s rights under GDPR and the right to lodge a complaint to the supervisory authority, the source of such data, automated decision-making, including profiling, and the safeguards applied in connection with the transfer of such data outside the European Union.
c) obtain a copy of your personal data.
6. The right to rectification of data – legal basis: article 16 of the GDPR.
7. The right to data portability – legal basis: article 20 of the GDPR.
8. Customer has the right to receive his/her personal data, which he/she has provided to the Controller, and then send it to another personal data controller of his/her choice. The Customer also has the right to request that the personal data be sent by the Controller directly to such controller, if technically possible. In this case, the Controller will send the Customer’s personal data in the form of a file in csv format, which is a commonly used, machine-readable format that allows for the transfer of the received data to another personal data Controller.
9. In the situation when the Customer exercises the rights resulting from the above rights, Little Tuscany Sp. z o.o. fulfills the request or refuses to fulfill it immediately, but no later than within one month after receiving it. However, if – due to the complexity of the request or the number of requests – Little Tuscany Sp. z o.o. is not able to meet the request within one month, it will meet it within the next two months, informing the Customer, within one month of receiving the request, about the intended extension of the deadline and the reasons for it.
10. The Customer may submit complaints, inquiries and requests to the Controller regarding the processing of his/her personal data and exercising his/her rights.
12. Customer shall have the right to lodge a complaint with the President of the Office for Personal Data Protection regarding infringement of their data protection rights or other rights granted under the GDPR.
5 § Security management – password
1. Little Tuscany Sp. z o.o. provides the Customers with a safe and encrypted connection during sending of personal data and during logging into the Customer’s Account on the Site. Little Tuscany Sp. z o.o. uses SSL certificate issued by one of the world’s leading companies in the field of security and encryption of data transmitted over the Internet.
2. In case the Customer with an account in the Online Store has lost his/her password in any way, the Online Store enables generating a new password. Little Tuscany Sp. z o.o. does not send password reminders. The password is stored in an encrypted form, in a way that makes it impossible to be read. In order to generate a new password, the e-mail address shall be entered in the form available under the link “You have forgotten your password”, provided while logging in to the Online Store account. The Customer shall receive an e-mail message to the e-mail address provided during the registration or saved in the last change of the account profile, containing a redirection to a dedicated form available on the Online Store’s Website, where the Customer shall have an opportunity to set a new password.
3. Little Tuscany Sp. z o.o. never sends any correspondence, including electronic correspondence, asking for login data, in particular, the password to access the Customer’s account.
Date last modified: 25.02.2022 r.