This Privacy Policy explains how GLOBTOS Sp. z o.o. processes the personal data of people using the online store available at https://globtos.com, and what rights those people have.

1. Data controller

The controller of your personal data is GLOBTOS Spółka z ograniczoną odpowiedzialnością, with its registered office at ul. Legnicka 60D, 54-204 Wrocław, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for Wrocław-Fabryczna, VI Commercial Division, under KRS number: 0000739617, NIP: 8943130424, REGON: 380742856.

You can contact the controller on any matter concerning personal data:

• by e-mail: globtos.web@gmail.com,
• by post: GLOBTOS Sp. z o.o., ul. Legnicka 60D, 54-204 Wrocław, Poland.

The controller has not appointed a Data Protection Officer.

2. What data we collect

We process data you provide yourself, as well as data collected automatically while you use the website.

• Order data: first and last name, delivery and billing address, e-mail address, phone number, company name and VAT ID (for business purchases), order details.
• Account data: e-mail address, password (stored in encrypted form), order history, saved addresses.
• Contact form and quote request data: first and last name, e-mail address, phone number, message content.
• Technical data: IP address, browser and device type, date and time of the visit, information stored in cookies.

3. Purposes and legal bases of processing

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), for the following purposes:

• Conclusion and performance of the sales contract, order handling, delivery and payment – Article 6(1)(b) GDPR.
• Maintaining the customer account – Article 6(1)(b) GDPR.
• Compliance with tax and accounting obligations, including issuing and storing accounting documents – Article 6(1)(c) GDPR.
• Handling complaints, returns and withdrawals from the contract – Article 6(1)(b) and (c) GDPR.
• Responding to enquiries sent through the contact form or the price enquiry form – Article 6(1)(f) GDPR (legitimate interest in communicating with a person interested in our offer).
• Sending the newsletter, if you subscribed – Article 6(1)(a) GDPR (consent), which you may withdraw at any time.
• Ensuring website security and protection against abuse, including the Google reCAPTCHA mechanism – Article 6(1)(f) GDPR.
• Establishing, pursuing and defending claims – Article 6(1)(f) GDPR.
• Statistics and marketing using cookies – Article 6(1)(a) GDPR (consent given in the consent banner).

4. Data recipients

We may share personal data only with entities involved in achieving the purposes above. These are:

• the hosting provider whose servers run the store,
• the electronic payment operator PayU handling transactions in the store,
• carriers and courier companies handling delivery: DHL, Geodis, FedEx,
• the accounting office and tax advisers – with respect to accounting records,
• providers of IT tools used on the website, including Google Ireland Limited (reCAPTCHA), OnTheGoSystems Limited (WPML) and Complianz B.V. (consent management),
• law firms and debt collection entities – where claims are pursued,
• public authorities, where the obligation to disclose data follows from the law.

Entities processing data on our behalf do so solely under a data processing agreement and within the scope we specify.

5. Transfers outside the European Economic Area

As a rule, we process data within the European Economic Area. Use of the Google reCAPTCHA service may involve a transfer of technical data to the United States. Such transfer takes place on the basis of the European Commission adequacy decision (EU-US Data Privacy Framework) and, in other cases, on the basis of standard contractual clauses approved by the European Commission.

6. Data retention periods

• Order data and accounting documents – 5 years, counted from the end of the calendar year in which the tax payment deadline expired.
• Customer account data – until the account is deleted by the user or a deletion request is submitted.
• Correspondence and price enquiries – up to 12 months from the end of the correspondence.
• Data processed on the basis of consent (newsletter, marketing cookies) – until consent is withdrawn.
• Data necessary to defend claims – until the limitation period for claims expires.

7. Your rights

In connection with the processing of personal data, you have the right to:

• access your data and obtain a copy of it,
• rectify (correct) your data,
• erase your data, where there is no basis for further processing,
• restrict processing,
• data portability – with respect to data processed on the basis of a contract or consent,
• object to processing based on a legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise these rights, write to globtos.web@gmail.com. We respond without undue delay and no later than one month from receiving the request.

8. Complaint to the supervisory authority

If you believe that we process your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).

9. Is providing data voluntary

Providing personal data is voluntary, but necessary to conclude and perform the sales contract, create an account or respond to an enquiry. Failure to provide the data will make these actions impossible. Providing data for the newsletter is entirely voluntary.

10. Automated decision-making and profiling

Personal data is not used for automated decision-making that would produce legal effects concerning you or similarly significantly affect you, including profiling.

11. Cookies

The store uses cookies. A detailed list of the cookies used, their purpose and storage period is described in the Cookies Policy. You can change the scope of the consents you have given at any time in the consent settings available on the website.

12. Changes to the Privacy Policy

This Policy may be updated, in particular if the law or the scope of services provided changes. The current version is always published on this page.