STD WEAR ONLINE STORE
PRIVACY POLICY

This Privacy Policy shall apply from the date on which the Online Store is launched and this Privacy Policy is published at www.stdwear.com.

1. GENERAL PROVISIONS

  1. This Privacy Policy sets out the principles governing the processing and protection of personal data of persons using the STD WEAR Online Store available at www.stdwear.com and its subdomains.
  2. This Privacy Policy is for information purposes and is intended to fulfil the information obligations arising in particular from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”).
  3. Capitalised terms not defined in this Privacy Policy shall have the meanings assigned to them in the STD WEAR Online Store Terms & Conditions.
  4. Providing personal data is generally voluntary; however, in certain cases it may be necessary to conclude and perform a Sales Contract, create a Customer Account, arrange delivery, process payments, contact the Store or use other Store functionalities.

2. DATA CONTROLLER

  1. The controller of your personal data is:
    HANT Spółka z ograniczoną odpowiedzialnością
    ul. Łąkowa 3/5
    90-562 Łódź
    Poland
    KRS: 0000793185
    NIP: 7272837721
    REGON: 383783471

    hereinafter referred to as the “Controller”, “HANT” or “STD WEAR”.
  2. You may contact the Controller regarding personal data protection matters:
    • by e-mail: info@stdwear.com,
    • by telephone: +48 604 907 571,
    • by post: HANT Sp. z o.o., ul. Łąkowa 3/5, 90-562 Łódź, Poland.

3. SCOPE, PURPOSES AND LEGAL BASES OF PROCESSING

  1. The Controller may process personal data for the following purposes:
    1. Processing Orders and performing Sales Contracts

      Personal data may be processed for the purpose of accepting and
      processing an Order, concluding and performing a Sales Contract,
      processing payments, delivering Products and communicating in
      connection with an Order. The legal basis is Article 6(1)(b) GDPR –
      processing necessary for entering into and performing a contract.
    2. Customer Account

      Where a Customer Account is created, personal data is processed for
      the purpose of creating and maintaining the Account and providing the
      functionalities associated with it. The legal basis is Article 6(1)(b)
      GDPR.
    3. Payments

      Personal data necessary to process payments may be transferred to
      payment service providers, in particular:
      • PayPro S.A. – Przelewy24,
      • InPost Pay,
      • other payment service providers where made available to the
        Customer in the Store.

      As a rule, the Controller does not receive the Customer’s complete
      payment instrument details, such as the full payment card number,
      where such information is provided directly to the payment service
      provider.

    4. Order Delivery

      Personal data necessary to deliver Products may be transferred to
      carriers and logistics operators selected by the Customer, in
      particular InPost Sp. z o.o. The data transferred may include, among
      other things, the Customer’s name, delivery address, e-mail
      address, telephone number and information necessary to identify and
      process the shipment.
    5. Enquiries and Customer Communications

      Personal data provided to the Controller by e-mail, contact form,
      telephone or other available communication channels may be processed
      for the purpose of responding to enquiries and handling
      correspondence.
      The legal basis may be Article 6(1)(b) GDPR where the communication
      relates to entering into or performing a contract, or Article 6(1)(f)
      GDPR – the Controller’s legitimate interest in handling
      correspondence and enquiries.
    6. Complaints, Returns and Withdrawal

      Personal data may be processed for the purpose of handling complaints,
      returns, withdrawals from Sales Contracts and exercising other
      Customer rights. The legal basis is Article 6(1)(b) and/or Article
      6(1)(c) GDPR.
    7. Tax and Accounting Obligations

      The Controller processes personal data to the extent required under
      applicable tax, accounting and other legal requirements. The legal
      basis is Article 6(1)(c) GDPR.
    8. Establishing, Exercising or Defending Legal Claims

      Personal data may be processed for the purpose of establishing,
      exercising or defending legal claims. The legal basis is Article
      6(1)(f) GDPR – the Controller’s legitimate interest.
    9. Newsletter and Direct Marketing

      Where the Customer or User has provided the relevant consent, their
      personal data may be used to send newsletters and information
      concerning, among other things, STD WEAR Products, new collections,
      launches, promotions and brand activities. The legal basis for
      processing personal data may be Article 6(1)(a) GDPR and, where
      applicable, Article 6(1)(f) GDPR, subject to the applicable rules
      governing electronic marketing communications.
      Newsletter service provider: MailerLite. Consent may be withdrawn at
      any time without affecting the lawfulness of processing carried out
      before its withdrawal.
    10. Analytics, Statistics and Online Marketing

      Depending on the consents provided by the User, the Controller may use
      analytical and marketing technologies to analyse how the Store is
      used, measure the effectiveness of marketing activities and, where the
      relevant consent has been provided, personalise advertising.
      Tools used by the Store: Google Analytics 4, Google Search Console.

4. CATEGORIES OF PERSONAL DATA

  1. Depending on how the Store is used, the Controller may process in particular:
    • first name and surname,
    • e-mail address,
    • telephone number,
    • delivery address,
    • billing address,
    • company details, including tax identification number, where applicable,
    • Order and Product purchase information,
    • payment and payment status information,
    • Customer Account information,
    • correspondence with the Controller,
    • complaint and return information,
    • IP address,
    • device and browser information and information concerning use of the
      Store,
    • online identifiers and data obtained from cookies and similar
      technologies, to the extent
    • permitted by the User’s consent settings.
  2. The Controller does not require special categories of personal data
    within the meaning of Article 9 GDPR.

5. RECIPIENTS OF PERSONAL DATA

  1. Personal data may be disclosed or entrusted to entities supporting the
    Controller in operating the Store, only to the extent necessary for the
    relevant purpose.
  2. Recipients may include in particular:
    • hosting service provider – cyber_Folks S.A., operating the zenbox.pl
      brand,
    • providers responsible for the Store’s technical infrastructure and
      WooCommerce support,
    • the agency supporting the Store, to the extent necessary to provide its
      services,
    • payment service providers – in particular PayPro S.A. (Przelewy24) and
      (InPost Pay),
    • carriers and logistics operators – in particular InPost Sp. z o.o.,
    • Newsletter service provider – MailerLite,
    • analytics and marketing service providers: Google Analytics 4, Google Search Console,
    • accounting, legal, IT and other professional service providers
      supporting the Controller, public authorities where disclosure is
      required by law.
  3. Entities processing personal data on behalf of the Controller act on the
    basis of appropriate agreements or other legal arrangements required under
    GDPR.

6. DATA RETENTION

  1. Personal data will not be retained for longer than necessary for the purpose for which it was collected, taking into account applicable legal requirements.
  2. In particular:
    • Order and Sales Contract data – for the duration of the contract and subsequently for the period required by law and until the expiry of applicable limitation periods,
    • accounting and tax data – for the period required by applicable law,
    • Customer Account data – for as long as the Account is maintained and subsequently to the extent necessary to comply with legal obligations or protect against claims,
    • complaint data – for the duration of complaint handling and the relevant limitation period,
    • data processed on the basis of consent – until consent is withdrawn, unless another legal basis permits continued processing,
    • data processed on the basis of legitimate interests – until an effective objection is made or the relevant legitimate interest ceases to exist.

7. DATA SUBJECT RIGHTS

  1. Subject to the conditions set out in GDPR, data subjects may have the right to:
    • access their personal data,
    • rectify their personal data,
    • erase their personal data (“right to be forgotten”),
    • restrict processing,
    • data portability,
    • object to processing,
    • withdraw consent at any time where processing is based on consent.
  2. Requests concerning these rights may be submitted to info@stdwear.com.
  3. A person who believes that their personal data is being processed in breach of applicable data protection law has the right to lodge a complaint with the competent supervisory authority. In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

8. COOKIES AND SIMILAR TECHNOLOGIES

  1. The Store uses cookies and similar technologies.
  2. Cookies may be used, among other purposes, to:
    • ensure the proper and secure operation of the Store,
    • maintain User sessions,
    • operate the Cart and Customer Account,
    • remember settings and preferences,
    • perform statistics and analytics,
    • measure the effectiveness of marketing activities,
    • personalise advertising where the User has provided the relevant
      consent.
  3. Cookies necessary for the proper operation of the Store may be used without
    additional consent to the extent permitted by applicable law.
  4. Analytics, advertising and other technologies that are not necessary for the
    proper operation of the Store are used in accordance with the choices made
    by the User through the Store’s consent management mechanism.
  5. The User may change or withdraw their consent at any time using the cookie
    settings available in the Store.

9. GOOGLE CONSENT MODE V2

  1. The Store uses Google Consent Mode v2 to communicate the User’s consent
    choices concerning certain types of data processing and storage to Google
    services.
  2. Consent Mode v2 may use, in particular, the following consent parameters:
    • analytics_storage – consent relating to storage for analytics purposes,
    • ad_storage – consent relating to storage for advertising purposes,
    • ad_user_data – consent relating to sending User data to Google for
      advertising purposes,
    • ad_personalization – consent relating to the use of data for
      personalised advertising.
  3. The behaviour of Google services is adjusted according to the choices made
    by the User through the consent management mechanism.
  4. Users may refuse consent for individual categories and may subsequently
    change their choices.

10. PROFILING AND AUTOMATED PROCESSING

  1. Where relevant marketing tools are used and the required consents have been
    obtained, data concerning the User’s activity in the Store may be used
    to create audience groups and tailor advertising content to the User’s
    interests.
  2. The Controller does not make decisions concerning Customers which produce
    legal effects or similarly significantly affect them solely on the basis of
    automated processing, unless a solution meeting the requirements of Article
    22 GDPR is introduced in the future, in which case Users will be
    appropriately informed.

11. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

12. DATA SECURITY

  1. Certain providers of tools used by the Store may process personal data
    outside the European Economic Area.
  2. Where personal data is transferred to a third country, the Controller
    ensures that transfer mechanisms required under GDPR are used as appropriate
    for the relevant provider and transfer, including an adequacy decision or
    Standard Contractual Clauses.
  1. The Controller implements appropriate technical and organisational measures designed to ensure a level of security appropriate to the risks associated with personal data processing.
  2. Access to personal data is restricted to persons and entities requiring such access in connection with their duties or services.
  3. The Store uses hosting services provided under the zenbox.pl brand. The scope of data processing by the hosting provider is governed by the applicable service agreement and data processing arrangements.

13. CHANGES TO THIS PRIVACY POLICY

  1. The Controller may update this Privacy Policy, in particular in the event of:
    • changes in applicable law,
    • changes to the operation or functionality of the Store,
    • introduction of new payment or delivery methods,
    • implementation of new analytics or marketing tools,
    • technological changes affecting personal data processing.
  2. The current version of this Privacy Policy will be available at www.stdwear.com.
  3. The effective date of the current version will be indicated at the beginning of this document.