Privacy Policy

This Privacy Policy outlines the principles for processing and protecting the personal data of users of the website sklep.bezdiamonds.pl (hereinafter referred to as the "Service") in connection with the data provided while using the Service's functionalities.

GENERAL PROVISIONS

1. Best Diamonds Markowski Spółka Komandytowa, registered in the National Court Register under number 0000963537, with its registered office at 15-111 Białystok, ul. Michała Motoszko 28, NIP 542-332-10-91, REGON 380786285, email address: [email protected], telephone number: 790 791 211, as the Controller of your personal data (hereinafter referred to as the "Controller" or "ADO"), cares about your privacy. Therefore, based on the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, p. 1), hereinafter referred to as "GDPR," we provide you with the most important information about the principles of processing your personal data by ADO, including cookies used by our online platform.

2. The Controller collects and processes personal data following applicable regulations, including the GDPR, and the data processing principles outlined therein. We strive to ensure transparency in data processing, particularly by always informing about data processing at the time of collection, including the purpose and legal basis for processing, such as when creating an account on the bestdiamonds.pl Service, concluding a contract, or subscribing to a newsletter. The Controller ensures that data is collected only to the extent necessary for the indicated purpose and processed only for as long as necessary.

3. The Controller places great importance on protecting your personal data and the entrusted information. The Controller's policy is focused on ensuring the highest possible confidentiality of personal data, particularly concerning protection against unauthorized access, unauthorized modification, disclosure, or destruction.

4. The Controller takes special care to protect the interests of individuals whose data is processed and ensures that the data is: a. Processed lawfully; b. Collected for specific, explicit, and legitimate purposes and not further processed in a manner inconsistent with those purposes; c. Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed; d. Accurate and, where necessary, kept up to date; e. Stored in a form that permits the identification of data subjects for no longer than is necessary for the purposes for which the data is processed.

5. If, despite the security measures in place, a personal data breach occurs (e.g., data leakage or loss), we will comply with the provisions of GDPR and inform the supervisory authority and affected individuals in a manner consistent with GDPR requirements.

DATA CONTROLLER

1. The Data Controller is Best Diamonds Markowski Spółka Komandytowa, with its registered office at 15-111 Białystok, ul. Michała Motoszko 28, registered in the Register of Entrepreneurs of the National Court Register under number KRS: 0000963537, NIP: 5423321091, REGON: 380786285 (hereinafter referred to as the "Company").

2. If you have any questions regarding the processing of your personal data and your rights, you can contact us: a. In writing, at the address: Best Diamonds Markowski sp.k., ul. Michała Motoszko 28, 15-111 Białystok, b. By phone at: 790 791 211, c. By email at: [email protected].

WHAT PERSONAL DATA DO WE PROCESS?

1. The Controller may process the following personal data of Users or Clients using the Service: name and surname; email address; contact telephone number (if you provide it in connection with your inquiry); delivery address (street, house number, apartment number, postal code, city, country), residence/business address/headquarters (if different from the delivery address), data related to order fulfillment, including payment. For Users or Clients who are not consumers, ADO may also process the company's name and the Client's tax identification number (NIP). Providing the personal data mentioned above may be necessary to conclude and execute the Sales Agreement or the Electronic Service Agreement on the Service. The required data for concluding the agreement is indicated on the Service's website and in the Online Store Regulations.

2. Depending on which Service functionalities you use, we process your data voluntarily provided by you for the following purposes: [...]

3. Accessing the Service and using certain functionalities without placing an order or registering on the Service generally does not involve providing personal data.

4. We do not process so-called sensitive data (e.g., personal data revealing racial or ethnic origin, political opinions, genetic data, biometric data, health data, sexual orientation, etc.).

5. We may also process your IP address for purposes described in the Cookies Policy.

WHY DO WE PROCESS YOUR DATA?

1. We process your personal data to provide our services and properly execute the agreement with you, as well as to handle complaints. The legal basis for processing your data in this regard is the necessity to perform the contract or take action at your request before entering into a contract or your consent.

2. This data may also be processed for marketing purposes, including sending newsletters, based on your consent.

3. For proper contract performance, your data is also processed for purposes related to billing, invoicing, and financial reporting. We must do this due to applicable legal regulations.

4. If you contact us via the contact details available on the Service, particularly to obtain information about our offer, we may process your personal data provided to us as a result of your contact to use our services or products.

5. Please note that providing your email address or phone number is a necessary condition for contacting you and presenting a possible offer from the Controller. Providing your personal data is voluntary. Failure to provide personal data may result in the inability to conclude a contract or fully or partially perform it, the inability to receive an offer, or the inability to communicate with you.

DISCLOSURE OF PERSONAL DATA

1. In connection with the services provided by ADO, your personal data may be disclosed to external entities, including, but not limited to, IT service providers responsible for managing IT systems used to provide online services, entities such as banks and payment operators in cases where the data subject uses electronic payment methods when placing an order, entities providing accounting services, courier and postal service companies, carriers or intermediaries handling shipments on behalf of ADO, marketing agencies (for marketing services), entities providing legal or accounting services, couriers, and entities providing other minor services necessary to execute the contract.

2. Your data may be disclosed to competent authorities or third parties who request such information based on an appropriate legal basis that imposes a legal obligation to provide the information, following applicable legal regulations. We disclose your data if requested by authorized state authorities, particularly the prosecution service, police, President of the Office for Personal Data Protection, President of the Office of Competition and Consumer Protection, or President of the Office of Electronic Communications.

3. ADO is aware that the level of personal data protection outside the European Economic Area (EEA) differs from that provided by European law. ADO will always inform you of its intention to transfer personal data outside the EEA at the data collection stage—currently, ADO does not use the services of such entities. The entities with which ADO cooperates are mainly located in Poland and other EEA countries. ADO transfers personal data outside the EEA only when necessary, ensuring an adequate level of protection, primarily by collaborating with entities that process personal data in countries for which an appropriate European Commission decision has been issued, applying standard contractual clauses issued by the European Commission, using binding corporate rules approved by the competent supervisory authority, and in the case of data transfers to the USA, cooperating with entities participating in the Privacy Shield program, approved by a European Commission decision.

HOW LONG DO WE STORE PERSONAL DATA?

1. The data processing period depends on the type of service provided and the purpose of processing. The data processing period may also be determined by legal regulations if they are the basis for processing.

2. We store your personal data for the duration of your account on the Service for account-related services and functionalities and other services following the Electronic Services Terms and Conditions. After the account is deleted, your data will be anonymized, except for the following personal data, which we will retain for complaint handling and claims related to using the Controller's services, or for establishing, exercising, or defending claims.

3. If the processing is necessary to conclude and perform a contract, the data will be processed for the service period or order fulfillment until the contract's completion and the post-sales period entitling you to certain claims against the Controller (e.g., warranty/guarantee).

4. If the processing is based on consent, the data will be processed until the consent is withdrawn, a valid objection is raised, or a request for data deletion is successfully made.

5. If the data is processed based on the Controller's legitimate interest, the data will be processed for a period that allows it to be fulfilled or until a valid objection to data processing is raised, or in the absence of an objection, until the legitimate interest exists.

6. Data processed for "Product Inquiry" will be stored for the duration of the correspondence. If you remain interested in our product/service and accept our price proposal, it will be processed as necessary to execute the contract following point 5 above.

7. Concerning personal data processed for marketing purposes, they will not be processed for longer than [...] months.

8. The data processing period may be extended if the processing is necessary to establish, exercise, or defend against potential claims, and after that period, only if and to the extent required by law. We will process your data only for as long as we have a legal basis for doing so, so until: a. We are no longer legally obligated to process your data, b. The possibility of pursuing claims related to the contract concluded by the Store has expired for either party, c. You withdraw your consent to data processing if consent was its basis, or you object to processing,

   • whichever happens latest.

9. After the processing period, the data is irreversibly deleted or anonymized.

WHAT RIGHTS DO YOU HAVE?

1. We ensure that your rights, as listed below, are respected. You can exercise your rights by submitting a request through the contact details provided in section IV above. The person whose data is concerned has the following rights: a. Right to rectify data: You have the right to rectify and supplement your personal data. Concerning other personal data, you have the right to ask us to rectify it (if it is incorrect) and complete it (if it is incomplete). b. Right to object to the use of data: You have the right to object at any time to using your personal data, including profiling, if we process your data based on our legitimate interest, e.g., in connection with statistics on the use of individual Service functionalities and facilitating the use of the Service, as well as satisfaction surveys. c. Right to delete data ("right to be forgotten"): You have the right to request the deletion of all or some of your personal data. A request to delete all personal data will be treated as a request to delete the account. You have the right to request the deletion of personal data if:
   • You have withdrawn a specific consent to the extent that the personal data was processed based on your consent;
   • Your personal data is no longer necessary for the purposes for which it was collected or processed;
   • You have objected to using your data for marketing purposes;
   • You have objected to using your data for statistical purposes, and the objection has been considered justified;
   • Your personal data is being processed unlawfully. d. Right to restrict data processing: You have the right to request that we limit the processing of your personal data. If you submit such a request, until we consider it, we will prevent you from using certain functionalities or services that involve processing the data covered by the request. We will also not send you any communications, including marketing communications.
   • You have the right to request that we limit the use of your personal data in the following cases:
     • When you question the accuracy of your personal data - in this case, we will limit its use while we verify its accuracy, but no longer than for 7 days;
     • When the processing of your data is unlawful, but instead of deleting it, you request that we limit its use;
     • When your personal data is no longer necessary for the purposes for which we collected or used it, but it is needed by you to establish, pursue, or defend claims;
     • When you have objected to using your data - in this case, the restriction is in place while we consider whether - due to your specific situation - the protection of your interests, rights, and freedoms overrides the interests we pursue by processing your personal data. e. Right to access data: You have the right to obtain confirmation from us as to whether we are processing your personal data, and if so, you have the right:
   • To access your personal data;
   • To obtain information about the purposes of processing, the categories of personal data processed, the recipients or categories of recipients of the data, the planned retention period for your data, or the criteria for determining that period, the rights you have under GDPR, the right to lodge a complaint with a supervisory authority, the source of the data, any automated decision-making, including profiling, and the safeguards in place for transferring the data outside the European Union;
   • To receive a copy of your personal data. f. Right to withdraw consent: If your data is processed based on the consent you have given, you have the right to withdraw it at any time, which, however, does not affect the lawfulness of the processing carried out before the withdrawal of consent. g. Right to data portability: You have the right to receive your personal data that you have provided to us, and then send it to another data controller of your choice, e.g., to another operator of similar services. You also have the right to request that the personal data be sent directly by us to such another controller, where technically feasible. We will send your personal data in a commonly used, machine-readable format that allows the data received to be transferred to another data controller.

PROFILING

1. As part of the Service, we may automatically tailor certain content to your needs, i.e., carry out profiling, using the personal data you provide. Before we profile based on which decisions are made: a. That produce legal effects concerning you, b. That affect you in a similarly significant way, we will ask for your consent. Remember that you can withdraw your consent at any time. Processing of data up until the point you withdraw your consent remains lawful.

2. Data may be used in the profiling process. Profiling of personal data by ADO involves processing data (including in an automated manner) by using it to assess certain information, particularly to analyze or predict personal preferences and interests related to ADO's offerings.

REQUIREMENT TO PROVIDE PERSONAL DATA

1. Providing your personal data is voluntary, but in some cases, it may be necessary to enter into a contract. Depending on the purpose for which the data is provided: a. It may be necessary to register on the Service (service provided electronically); b. It may be required to use the Service's services (service provided electronically - inquiry about the offer and contact form).

WHAT YOU CANNOT DO?

1. You cannot provide personal data of any other person.
2. You are required to comply with the legal regulations concerning personal data protection.

HOW DO WE SECURE PERSONAL DATA?

1. Personal data security is guaranteed by a secure and stable data protection system used by the Controller.

2. Login and data entry points are protected at the transmission layer (SSL certificate). As a result, personal data and login information entered on the website are encrypted on the user's computer and can only be read on the target server.

3. Personal data stored in the database is encrypted in such a way that only the Controller with the key can read it. Therefore, the data is protected in the event of a database theft from the server.

4. User passwords are stored in a hashed form. The hashing function is one-way - it is impossible to reverse its action, which is the current standard in storing user passwords.

5. The Controller periodically changes its administrative passwords.

6. A crucial element of data protection is regularly updating all software used by the Controller to process personal data, particularly regular updates of software components.

COOKIES POLICY

1. The Service does not automatically collect any information except for the information contained in cookies.

2. Cookies are IT data, specifically text files, stored on the user's device to use the Service's websites. Cookies usually contain the website's name they originate from, the time they are stored on the end device, and a unique number.

3. The entity placing cookies on the user's device and accessing them is the Administrator. Cookies may also be placed on the user's device by the Service operator's partners.

4. Cookies are used to: a. Enable the implementation of specific services available on the Service. b. Create statistics that help understand how users use the Service's websites, which allows improving their structure and content; c. Customize the content of the Service's websites to the user's preferences and optimize the use of websites; in particular, these files allow recognizing the user's device and appropriately displaying the website, tailored to their individual needs;

5. The Service uses two types of cookies: "session" cookies and "persistent" cookies. "Session" cookies are temporary files stored on the user's device until they leave the website or turn off the software (web browser). "Persistent" cookies are stored on the user's device for the time specified in the cookie parameters or until the user deletes them.

6. The Service may use the following types of cookies: a. "Essential" cookies, enabling the use of certain services available on the Service; b. "Performance" cookies, enabling the collection of information on how the Service's websites are used for statistical purposes.

7. Additionally, the Administrator uses statistical analysis of traffic on the website through Google Analytics (Google Inc. based in the USA). The Administrator does not transfer personal data to the operator of this service, only anonymized information. The service is based on the use of cookies on the user's device. Regarding information about the user's preferences collected by Google's advertising network, the user can view and edit information derived from cookies using the tool: https://www.google.com/ads/preferences/

8. The Administrator uses remarketing techniques, allowing tailoring advertising messages to the user's behavior on the site, which may give the illusion that the user's personal data is used to track them, but in practice, no personal data is transferred from the Administrator to advertising operators. The technological condition for such actions is enabled cookie support.

9. In many cases, the software used for browsing websites (web browser) allows cookies to be stored on the user's device by default. Users of the Service can change cookie settings at any time. These settings can be changed, particularly to block the automatic handling of cookies in the web browser settings or inform about them being placed on the user's device each time. Detailed information on cookie management options and methods is available in the software settings (web browser).

10. The Service operator informs that limiting the use of cookies may affect the availability of certain services on the Service's websites.

11. Cookies placed on the user's device may also be used by the Service operator's partners.

12. In connection with the use of cookies, profiling may occur to tailor the content of the Service's websites to the user's preferences and optimize the use of websites. However, no automated decision-making occurs in this regard.

13. More information about cookies is available in the "Help" section of the used web browser's menu.

FINAL PROVISIONS

1. The Service may contain links to other websites. The Administrator recommends that after switching to other websites, users familiarize themselves with the privacy policy established there. This privacy policy applies only to this Service.

2. The Administrator will inform Service users of any changes to the Privacy Policy.