Personal data – GDPR

What is GDPR?

It stands for the General Data Protection Regulation. Among other things, GDPR introduces new rights for individuals. One of the obligations of controllers (including our company) who process personal data is to inform people about the processing of their personal data. Below we have included information on how we process your personal data in connection with the services that are available on our website inglotcosmetics.com

Who is the controller of my personal data?

The controller of your personal data is "INGLOT" Spółka z ograniczoną odpowiedzialnością with its registered office at ul. Lwowska 154, 37-700 Przemyśl.

In matters of data protection, you can contact INGLOT in person at the Company's Headquarters or through the contact form available on our website (inglotcosmetics.com/en/contact-us). We also encourage you to contact us via email personal-data@inglotcosmetics.com

Manner, purpose, legal basis and duration of processing of your personal data

Provision of Services by Electronic Means through the Online Store

The purpose of processing your personal data is to enable you to use the functionality of our online store. At this stage, we will need your basic personal information, age (to determine whether you have legal capacity, i.e. to place orders and make payments) and email address.

Over time and in connection with your use of the functionality of our online store, we will collect information about you, which will relate to the information you voluntarily provide such as:

• Delivery addresses for orders placed;
• History and details of completed orders;
• Your receipts (invoices, receipts and other accounting evidence);
• Discount/promotional vouchers that you will receive in connection with your orders;
• Your wish lists (regarding our products);
• Information about stored payment cards (logo, card brand, card number, registration date) that you can add to your account to streamline the purchasing process.

When you register an account, we undertake to provide you with the services and functionality of the online store. Thus, a contract is concluded between us for the provision of electronic services under the provisions of the Act on the Provision of Electronic Services. The legal basis for processing your personal data will be Article 6(1)(b) GDPR (conclusion of a contract).

By clicking on the "Register" button after providing the required personal information on the new user registration page, you enter into a contract with us for the provision of electronic services under the terms and conditions set forth in the Regulations.

We will retain your data until you delete your user account. It is possible that the account will be deleted by us earlier in case of long-term inactivity of the account. However, in this case, we will inform you in advance of such activities.

Providing your personal information at this stage is voluntary, but failure to do so will prevent you from using the features of our online store available to registered users.

Conclusion of contracts of sale and purchase of goods offered by our company

The purpose of processing your personal data is to enable you to place and process orders through our online store. By placing and confirming an order, a long-distance purchase contract is concluded between us. Thus, the legal basis for processing your personal data will be Article 6(1)(b) GDPR (conclusion of a contract).

At this stage we will need your basic personal data; optionally your company data, address data and telephone number (for the purpose of delivery of ordered goods by courier companies cooperating with us). In addition, we will process payment information pertaining to you such as your bank account number or the number of a payment card or other payment service you choose as a payment method (e.g. Blik). 

We will retain your data for a period of 5 years after the end of the fiscal year in accordance with the provisions of the Tax Ordinance Act and the Value Added Tax Act.

Providing your personal data at this stage is voluntary, but failure to do so will prevent the conclusion of a purchase agreement, and thus completion of the order.

Handling consumer rights, warranty and guarantee

The purpose of processing your personal data is to enable you to exercise your consumer rights, including the warranty and guarantee that we provide for the products offered. By submitting a complaint or return request, you are exercising your consumer rights under the contract. Thus, the legal basis for the processing of your personal data will be Article 6(1)(b) GDPR (handling of contractual rights).

At this stage we will need your basic personal data, optionally your company data, address details and telephone number (for the purpose of delivery of new goods – if the complaint is accepted, by courier companies cooperating with us). Here we will need information from you about what constitutes grounds for complaint or return of purchased goods.

In addition, we will process payment information pertaining to you such as your bank account number or the number of a payment card or other payment service you choose as a payment method (e.g., Blik) for the purpose of refunding the funds paid if you are not interested in the new merchandise and decide to return the funds paid. 

We will retain your data for a period of 5 years after the end of the fiscal year in accordance with the provisions of the Tax Ordinance Act and the Value Added Tax Act.

Providing your personal information at this stage is voluntary, but failure to do so may make it impossible or significantly more difficult to exercise your consumer rights. This will have the effect of making it significantly more difficult to handle your requests or leaving them unprocessed.

Contact form

The purpose of processing your personal data is to enable you to contact our Customer Service or IT Department on any matter that concerns our business.

When you send us a message, we will process your personal data in the form of your e-mail address in order to respond to your message. Thus, the legal basis for the processing of your personal data will be Article 6(1)(f) GDPR (the controller's legitimate interest in responding to directed messages from customers or others).

It is possible that at this stage we will need other categories of data that cannot be predicted at this time, which will be necessary to recognize the case you refer to us.

We will keep your data for as long as your user account exists (if you register it) or for a period of 3 years (if you are not a registered user of our online store).

Providing your personal information at this stage is voluntary, but failure to do so may prevent the handling of the message sent. This may result in your message being left unprocessed.

Using the INGLOT loyalty card

The purpose of processing your personal data is to enable you to claim shopping benefits (including promotions and discounts) resulting from your participation in the INGLOT "Beauty Reward" program.

By sending us a completed application for enrollment in the INGLOT "Beauty Reward" program, you consent to the processing of your personal data contained on the application. Thus, the legal basis for the processing of your personal data will be Article 6(1)(a) GDPR (consent expressed through a clear affirmative action, i.e. by submitting a completed application for enrollment in the INGLOT "Beauty Reward" program)

The personal information we will process about you is basic personal information and contact information (such as email or phone number).

We will keep your data for as long as you participate in the INGLOT "Beauty Reward" program.

We will keep your data until you withdraw your participation in the program. It is possible that your data will be deleted by us sooner in case of your long-term inactivity within the Program. However, in this case, we will inform you in advance of such activities.

Providing your personal information at this stage is voluntary, but failure to do so may prevent you from participating in the Program. This will result in the inability to take advantage of the benefits available under the program.

Newsletter

The purpose of processing your personal data is to enable you to use the newsletter functionality of our online store which consists in sending you commercial information to the indicated e-mail address. At this stage we will only need your email address.

By clicking on the "Subscribe" button after providing the required personal information on our website inglotcosmetics.com you consent to the processing of your personal data and to receive commercial information. Thus, the legal basis for the processing of your personal data will be Article 6(1)(a) GDPR (consent expressed through a clear affirmative action, i.e. by pressing the "Subscribe" button).

Effective from 04.05.2019, the provisions of the Act of 18 July 2002 on the provision of electronic services require that consent to receive commercial information (among other things, as part of a newsletter) meet the requirements set forth in the Regulation of the European Parliament and of the Council 2016/679 (GDPR).

This means that by providing your e-mail address and pressing the “Subscribe" button, you consent to the processing of your personal data, so that we can send you commercial information as part of the newsletter service. Your consent is not in the form of a written statement (traditional consent), but takes the form of an explicit affirmative action.

Remember that you always have the right to revoke the consent granted for data processing (without affecting the lawfulness of the processing performed on the basis of consent before its revocation).

We will retain your data until you unsubscribe from the newsletter service. Unsubscribing from the service – and thus withdrawing the consent you have given – is possible by clicking on the "Unsubscribe me from the newsletter" link at the bottom of each commercial information message we send, or by using the contact form.

Providing your personal information at this stage is voluntary, but failure to do so may prevent the rendering of the newsletter service. This will result in the inability to receive information as part of the newsletter service.

Mobile Marketing

The purpose of processing your personal data is to enable you to take advantage of the functionality of our online store called "Mobile Marketing", which consists in sending you commercial information to a designated phone number in the form of a text message. At this stage we will only need your phone number.

The Mobile Marketing service is provided at INGLOT's expense.

By clicking on the "Subscribe" button when registering a user account, shopping as a guest, or in connection with managing your privacy preferences, and by providing the required personal information on our website inglotcosmetics.com, you consent to the processing of your personal information and to the receipt of commercial information. Thus, the legal basis for the processing of your personal data will be Article 6(1)(a) GDPR (consent expressed through a clear affirmative action, i.e. by pressing the "Subscribe" button).

Effective as of 04.05.2019, the provisions of the Act of July 18, 2002 on the provision of electronic services, in the case of sending commercial information (including text marketing), and Article 172 of the Telecommunications Law of July 16, 2004, in the case of the use of telecommunications terminal equipment and automatic calling systems for marketing purposes, require that such consents meet the requirements of Regulation 2016/679 of the European Parliament and of the Council (GDPR).

This means that by providing your phone number and pressing the “Subscribe" button, you consent to the processing of your personal data, so that we can send you commercial information as part of the Mobile Marketing service. Your consent is not in the form of a written statement (traditional consent), but takes the form of an explicit affirmative action – information about such action will be recorded in the logs of our online store.

Remember that you always have the right to revoke the consent granted for data processing (without affecting the lawfulness of the processing performed on the basis of consent before its revocation).

We will keep your data until you unsubscribe from the Mobile Marketing service. Unsubscribing from the service – and thus withdrawing the given consent – is possible through the "My Account" panel in the "Your Personal Data" tab available at: https://inglotcosmetics.com/en/identity.

Providing your personal information at this stage is voluntary, but failure to do so may prevent you from providing the Mobile Marketing service. This will result in the inability to receive information within the Mobile Marketing service.

Can I have access to my data?

Yes. You can have full access to your personal information. You can also manage your personal data processing consents, including marketing consents. Access is available for registered users under the tab My Account. Access to data for those who have not registered a user account is possible only when you contact us via e-mail at: personal-data@inglotcosmetics.com

How can I contact the Company's data protection officer?

You can contact the person responsible for data protection at INGLOT in the Company at the following email address: personal-data@inglotcosmetics.com

Who is the recipient of my data?

Your personal data that we process for the purposes described above may be transferred to data recipients performing services for INGLOT, to entities entrusted by INGLOT to process personal data under contracts, and to entities entitled to obtain personal data under the law. These will include, in particular:

• Global-e NL B.V., Krijn Taconiskade 430, 1087 HW Amsterdam, The Netherlands, Company Number: 72541466, VAT Registration: NL 859146492B01 - in support of processes related to the in cross-border e-commerce;
• CRITEO Polska (Criteo SA) with its registered office at 32 Rue Blanche, 75009 Paris, France, VAT EU: 484 786 249 RCS Paris, telephone: +33 (0) 1 40 40 22 90, e-mail address: contact@criteo.com – in support of processes related to the marketing of our products;
• SALESmanago (BENHAUER Sp. z o.o., ul. Grzegórzecka 21, 31-532 Kraków, KRS: 0000523346) – in support of processes related to the marketing of our products;
• LastLevel Sp. z o.o., ul. Władysława Trylińskiego 16/12, 10-683 Olsztyn, KRS: 0000732158, NIP 7393912918, REGON 369692503, phone: +48 89 6120725, email: kontakt@lastlevel.pl – for software maintenance;
• Ceneo.pl sp. z o.o. – Ceneo.pl sp. z o.o. located in Poznań, ul. Grunwaldzka 182, 60-166 Poznan, KRS: 0000634928, NIP 525-26-74-781, REGON 365338986 – with regard to collecting via e-mail Surveys (or informing about the website on which they are provided) for the purpose of obtaining feedback from the Buyer on the transaction made by the Buyer in our online store. The data from the survey completed by the Buyer is posted on the Ceneo Website;
• Google Ireland Limited ("Google") with respect to cookies concerning you, which are transferred to Google in connection with the use of its services (Google Adwords, Google Ads, Google Analytics) by INGLOT;
• Courier companies cooperating with us in carrying out the delivery of products ordered by you and making any returns.
• Law firms cooperating with us in the recognition of complaints or returns that you can report to us.

Will my personal data be transferred to a third country or international organization?

Yes. Your personal information may be shared with our partners who provide services that allow you to use the full functionality of our online store. They are:

• Google Ireland Limited ("Google") with respect to cookies concerning you, which are transferred to Google in connection with the use of its services (Google Adwords, Google Ads, Google Analytics).

In the aforementioned cases, the mechanism that legalizes the processing and transfer of personal data outside the European Economic Area is the so-called Standard Contractual Clauses in the Controller-Processor Variant adopted by the European Commission Decision of February 5, 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council (notified as document No. C(2010) 593).

What rights am I entitled to?

In connection with INGLOT's processing of your personal data, you have rights under the terms of the GDPR to:

• access to the content of your data (Article 15 GDPR),
• rectify data (Article 16 GDPR),
• delete the data (Article 17 GDPR),
• restrict the data processing (Article 18 GDPR),
• data portability (Article 20 GDPR),
• object to the processing of data (Article 21 GDPR),
• not to be subject to decisions made under conditions of automated data processing, including profiling (Article 22 GDPR).

To whom can I file a complaint?

In cases where you consider that the processing of your data violates the provisions of GDPR, you have the right to lodge a complaint with the supervisory authority of the President of the Office for Personal Data Protection, ul. Stawki 2, 00-193 Warsaw (kancelaria@uodo.gov.pl)

How did INGLOT get my personal information?

The sources of your personal data are the application forms and contracts entered into with INGLOT, while in the case of obtaining personal data by means other than from data subjects, the sources are third parties. INGLOT is then obliged to inform you of the source of obtaining their data.

Will INGLOT make automated decisions about you?

We currently allow for the possibility that so-called automated decision-making occurs during your use of our website. Automated decision-making is when, based on your data, an automated mechanism makes decisions – without human input – that affect you. In the case of our website, we use your cookies in our automated decision-making process. For more information on what cookies are and how to disable them, see our Privacy Policy.

Our website inglotcosmetics.com uses mechanisms based on artificial intelligence and so-called machine learning. These mechanisms operate on the basis of your cookies, which we collect in connection with your presence and activity on our website.

The effect on you of automated decision-making by the mechanisms described above is the following actions taken by our site based on analysis of the content you view:

• Displaying messages and content (pop-up, exit pop-up) in the browser window. Example:

When you add items to your shopping cart but do not place the order, we will remind you through messages displayed on the open website that the order has not been completed to the end.

• Displaying pop-up notifications in the operating system layer. Example:

Even if you do not browse our website, we allow the possibility that based on your consent, we will show you notifications regarding news on our website.

• Sending SMS messages after or during your visit to our website – only if you have given us your phone number and consented to its use for marketing purposes. Example:

Based on your activity on the website (your interests, likes, purchases), after analyzing cookies, we gained knowledge that you were interested in a group or a specific product, but did not decide to purchase it. The tools running on our site will be able to decide to send you an SMS encouraging you to make a purchase.

• Sending dynamic emails during or after your visit to our website – only if you have provided us with your email address and consented to its use for marketing purposes. Example:

Based on your activity on the website (your interests, likes, purchases), after analyzing cookies, we gained knowledge that you were interested in a group or a specific product, but did not decide to purchase it. The tools running on our website will be capable of deciding to send you e-mails encouraging you to make a purchase or send you more information about a product you are interested in.

Based on your activity on the website (your interests, likes, purchases), after analyzing cookies, we will want to target you with educational campaigns about the products offered by our company.

• Conducting live chat with product recommendations. Example:

Based on your activity on the website (your interests, likes, purchases), after analyzing the cookies, we will want to direct messages (e.g. product recommendations) to you via the chat box available on our website.

• Displaying dynamic content or advertisements on our website or on other websites (so-called remarketing, i.e., displaying our ads on other websites) through the services of our Partners (e.g., Google). Example:

 If you browse other websites that use Google's services (our Partners) in the advertising spaces you will be presented with content that is not random. This will be content about our products presented based on your cookies.

 If you do not want to be subject to the effects of decisions taken by automated means, you need to block the storage of our cookies in your browser. For more information on what cookies are and how to disable them, see our Privacy Policy.

Will my personal data be subject to profiling?

To begin with, we want to explain what profiling is. As defined in the GDPR, profiling "means any form of automated processing of personal data that involves the use of personal data to evaluate certain personal factors of an individual, in particular to analyze or predict aspects concerning that individual's performance, economic situation, health, personal preferences, interests, reliability, behavior, location or movement”.

 Due to the artificial intelligence and machine learning mechanisms operating on our website, there will be profiling of your personal data in connection with your activity on our website.

 The result of profiling (including automated decision-making, as we reported above) will be:

• determining your interest in the products offered by INGLOT;

• researching the market and your behavior and preferences;

• determining the directions and actions necessary to improve the quality of our services (online store) and products.

The only consequence for you will be the display or transmission of notifications, messages, texts, e-mails, or the conduct of other information / marketing activities by the automated mechanism. If you opt out (by blocking our cookies from being stored on your device) of profiling, you will not face any negative consequences. Advertisements and other marketing information will continue to be published, but they will be less tailored to you.

For more information on what cookies are and how to disable them, see our Privacy Policy.