PRIVACY POLICY

I. General provisions

1. The privacy policy defines how Users' personal data necessary for the provision of electronic services via the secretroomgdansk.pl website (hereinafter: the website) is collected, processed, and stored.
2. The website collects only personal data necessary for the provision and development of the services offered therein.
3. Personal data collected via the Website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/WE (General Data Protection Regulation, hereinafter referred to as GDPR) and the Personal Data Protection Act of May 10, 2018.

II. Data controller
The controller of personal data collected through the Website is
Eldar Kurseitov, address: al. Grunwaldzka 69, 80-241 Gdańsk, NIP: 5842794144, REGON: 386285549,
e-mail address: kontakt@secretroomgdansk.pl (hereinafter: Administrator).

III. Purpose of collecting personal data

1. Personal data is used for the following purposes:

• performance of the contract for services and e-services,
• communication with the User (live chat, contact form, etc.)
• sending newsletters (after the User has consented to receive them),
• maintaining a comment system,
• providing social services,
• promoting the Administrator's offer,
• marketing, remarketing, affiliation,
• personalizing the Website for Users,
• analytical and statistical activities,
• establishing and pursuing claims or defending against them.

1. Providing data is voluntary, but necessary to conclude a contract or use other functionalities of the Website.

IV. Type of personal data processed
The Administrator may process the User's personal data: name and surname, date of birth, e-mail address, telephone number.

V. Period of personal data processing
Users' personal data will be processed for the following periods:

• when the basis for data processing is the performance of a contract – until the claims expire after its performance,
• when the basis for data processing is consent – until its cancellation, and after cancellation of consent, until the claims expire.

In both cases, the limitation period is 6 years, and for claims for periodic benefits and claims related to business activities, 3 years (unless a specific provision provides otherwise).

VI. Sharing personal data

1. Users' personal data may be transferred to: entities affiliated with the Administrator, its subcontractors, entities cooperating with the Administrator, e.g., companies handling e-payments, companies providing courier/postal services, and law firms.
2. Users' personal data will not be transferred outside the European Economic Area (EEA).

VII. User Rights

1. The Website User has the right to: access their personal data, rectify it, delete it, restrict its processing, transfer it, object to its processing, and withdraw their consent at any time (which does not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal).
2. A notification of the User exercising their rights should be sent to kontakt@secretroomgdansk.pl.
3. The Administrator shall comply with or refuse to comply with the request immediately, within a maximum of one month of receiving it.
4. The User has the right to lodge a complaint with the President of the Personal Data Protection Office if they consider that the processing violates their rights and freedoms (GDPR).

VIII. Cookies

1. The Website collects information using cookies – session cookies, persistent cookies, and third-party cookies.
2. The collection of cookies supports the proper provision of services on the Website and serves statistical purposes.
3. The User may specify the scope of access of cookies to their device in their browser settings.

IX. Automated decision-making and profiling

1. User data cannot be processed in an automated manner in such a way that any decisions could be made about them as a result.
2. User data may be profiled for the purpose of customizing content and personalizing offers after they have given their consent.

X. Final provisions

1. The Administrator has the right to make changes to the Privacy Policy, but the rights of Users will not be limited.
2. Information about the changes made will appear in the form of a message available on the Website.
3. In matters not covered by this Privacy Policy, the provisions of the GDPR and Polish law shall apply.